MSDEVBUILD / azure

Azure Role-Based Access Control (RBAC)

👤Whosecurity principaluser, group, app📜Whatrole definitionOwner, Contributor, Reader📦WherescopeMG, subscription, RG, resource++= Role assignment 🔐
Who, plus what, plus where, equals a role assignment. Give each person only the keys they need.

😟 THE PROBLEM

Everyone is an Owner, and a new hire deletes production by accident.

😊 THE SOLUTION

Assign least-privilege roles at the right scope with Azure RBAC.

  • Everyone has full control✓ Contributor or Reader roles
  • Access too broad✓ Assign at the right scope
  • Managing people one by one✓ Assign roles to groups
🛠️ Solved with: Azure RBAC
Module 2: Architecture & Services ⏱ 6 min read Updated 11 Nov 2026

Quick answer

Azure role-based access control (RBAC) manages who can do what on which Azure resources. You create a role assignment combining a security principal (user, group or app), a role definition (such as Owner, Contributor or Reader) and a scope (management group, subscription, resource group or resource). Permissions are inherited by child scopes.

Exam objective: 2.4.5 Describe Azure role-based access control (RBAC). (Skills measured as of July 20, 2026)

Start with a question

Should the new intern be able to delete the production database?

Certainly not. Azure RBAC makes sure each person gets just the access they need.

Explain it like I’m 10

The technical explanation

Built-in roleCan do
OwnerEverything, including granting access to others
ContributorCreate and manage resources, but not grant access
ReaderView resources only
User Access AdministratorManage user access only

Role assignments at a scope are inherited by all child scopes. RBAC uses an allow model: permissions add up across assignments.

Real-world business scenario

Enterprise

A software agency

The problem
All developers were Owners on the production subscription, and an accidental deletion caused an outage.
What they used
Developers got Contributor on dev resource groups and Reader on production; a small ops group got Contributor on production.
Why that choice
Least privilege limits the damage from mistakes and compromised accounts.
The result
No more accidental production changes, and audits became simple.

When to use it and when not to

✓ Use it when…

  • Always, to grant access by role and scope.
  • Assign roles to groups rather than individuals.

✕ Think twice when…

  • Broad Owner assignments at high scopes.
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner What is Azure RBAC?

Model answer

The way Azure controls who can do what. I assign a role, like Reader, to a person or group at a scope, like a resource group, and they get exactly those permissions there.

Intermediate What are the most common built-in roles?

Model answer

Owner (full access, including assigning access), Contributor (create and manage resources but not grant access), Reader (view only), and User Access Administrator (manage access only).

Experienced developer How do RBAC and Azure Policy differ, and how do they work together?

Model answer

RBAC controls who can perform actions. Policy controls what resources may look like. A Contributor can create a VM, but Policy can still deny it if it is in a non-approved region or size. Together they enforce both permissions and standards.

Test yourself with exercises

3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 3

Which built-in role can manage resources but cannot grant access to others?

Question 2

Question 2 of 3

What three elements make up an Azure role assignment?

Question 3

Question 3 of 3

An auditor must view all resources in a subscription without changing anything. Which role?

Quick revision

Key points

  • RBAC = who (principal) + what (role) + where (scope).
  • Scopes are management group, subscription, resource group or resource.
  • Permissions inherit down the hierarchy.
  • Built-in roles include Owner, Contributor, Reader and User Access Administrator.
  • Follow least privilege.

Important terminology

Security principal
A user, group, service principal or managed identity that receives access.
Role definition
A collection of permissions, such as Reader or Contributor.
Scope
Where the access applies: management group, subscription, resource group or resource.
Least privilege
Giving only the minimum permissions needed to do the job.

Common mistakes

  • Giving everyone Owner to "save time".
  • Confusing RBAC (who) with Policy (what resources look like).

Exam tips

  • "Allow a user to view but not change resources" = assign the Reader role.

Five quick revision questions

  1. 1.What three things make up a role assignment?Show

    A security principal, a role definition and a scope.

  2. 2.Which role can create resources but not grant access?Show

    Contributor.

  3. 3.Which role can only view?Show

    Reader.

  4. 4.Do permissions assigned at a subscription apply to its resource groups?Show

    Yes, through inheritance.

  5. 5.What is least privilege?Show

    Giving only the minimum access needed.

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: Zero Trust