Role-Based Access Control (RBAC)

In the previous lesson, we learned how to create users and groups in Microsoft Entra ID.

However, creating an identity does not automatically give that identity permission to manage Azure resources.

A user might be able to sign in to Azure, but this does not mean that they are allowed to create, change, or delete resources.

To control this access, Azure uses Role-Based Access Control, also known as Azure RBAC.

What is authorization?

Authorization is the process of establishing what actions a certain identity is allowed to do.

For example, is a user named Marcus from the Marketing department allowed to delete a Virtual Machine in West Europe?

Authorization is the process of checking whether Marcus is allowed to perform that action.

Oftentimes when encountering the term “authorization” you will also see “authentication” mentioned. These two terms do not refer to the same thing.

Authentication answers the question “who are you?”

Authorization answers the question “what are you allowed to do?”

In Azure, Entra ID is responsible for authentication (when you sign in), and Azure RBAC is responsible for authorization (once you’re logged in,  what are you allowed to do?).

Identities in Azure are authorized to perform actions based on the roles that are assigned to them.

What is a role?

A role in Azure is a set of permissions that allow an identity to perform certain actions.

An example of a permission is the ability to create a Storage Account.

Another example is the ability to create an Azure SQL Database.

Most of the time, a role contains more than one permission. For instance, a role to manage Virtual Machines could contain the following permissions:

• Create Virtual Machines
• Start and Stop Virtual Machines
• Restart Virtual Machines
• Change the size of Virtual Machines
• Delete Virtual Machines

Azure contains many roles that are already defined and ready to use. These come out of the box and are called “built-in roles”.

Examples of built-in roles include:

• Owner
• Contributor
• Reader
• Virtual Machine Contributor
• Network Contributor

You can also create your own roles, which in Azure are named “custom roles”.

Custom roles are useful when the roles defined by Azure do not meet your specific needs and you need a set of permissions that aren’t bundled nicely in a built-in role.

For example, you might create a custom role that allows a support engineer to Restart Virtual Machines but does not allow him to Delete Virtual Machines.

What is a role assignment?

An identity becomes authorized to perform certain actions when a role is assigned to it.

However, assigning a role requires more than choosing a role.

You also need to decide:

• Which identity receives the role
• Which role the identity receives
• Where the role applies

The location where the role applies is called the scope.

A role assignment is a role assigned to an identity at a certain scope.

Role Assignment = Identity + Role + Scope

An example of a role assignment is:

• Identity: Marcus
• Role: Virtual Machine Contributor
• Scope: Production-Resource-Group

This role assignment allows Marcus to manage the Virtual Machines in the resources group Production-Resource-Group. This is because the role applies only to the scope that is has been assigned to.

What is a scope?

A scope defines where a role assignment applies.

Azure supports the following scopes:

• Management Group
• Subscription
• Resource Group
• Resource

A role assigned at the Management Group applies to all subscriptions, resources groups, and resources below it.

Example: Marcus could be assigned the Owner role to the ZeroToArchitect-Mng management group, allowing him to perform any action in any subscription.

A role assigned at the Subscription scope applies to all resource groups and resources inside it.

Example: Marcus could be assigned the Reader role to the ZeroToArchitect-Sub subscription, allowing him to view every resource inside the subscription.

A role assigned at the Resource Group scope applies to all resources inside it.

Example: Marcus could be assigned the Contributor role to the Development-RG resource group, allowing him to manage all resources inside that resource group.

A role assigned at the Resource scope applies only to that resource.

Example: Marcus could be assigned the Virtual Machine Contributor role only on one specific Virtual Machine.

Owner vs Contributor vs Reader roles

The Owner role allows an identity to create, modify, and delete all resources within the assigned scope, as well as granting and removing access to other identities in that scope .

The Contributor role allows an identity to create, modify, and delete resources within the assigned scope.

The Reader role allows an identity to view resources without modifying them.

What to remember for your exam

• Authorization is the process of verifying what an identity is allowed to do.
• Authentication is the process of verifying who an identity is.
• A role is a set of permissions.
• A role assignment connects a role to an identity at a certain scope.
• The possible scopes are: Management Groups, Subscriptions, Resource Groups, Resources.
• Role assignments are inherited by the scopes below them.
• The Owner role can manage resources AND grant access to other identities.
• The Contributor role can manage resources but CANNOT grant access to other identities.
• The Reader role can only view resources.

What’s next?

Now that you know what Azure RBAC is and how identities are granted access to Azure resources, let’s move on to the next topic: Service Principals.