1.2 - Azure RBAC roles, assignments and scope
AZ-104 objective 1.2 covers Azure role-based access control (RBAC). A role assignment is made of exactly three parts: a security principal (a user, group, service principal or managed identity), a role definition, and a scope. Scope is inherited downward, so a Reader assigned at a resource group applies to every resource inside it but nowhere else, and you follow least privilege by granting the narrowest built-in role that does the job. To let an auditor inspect configurations across a subscription without changing anything you assign Reader; to manage access itself you need User Access Administrator or Owner. Azure RBAC governs Azure resources and is separate from Microsoft Entra roles, which manage the directory; a Global Administrator can elevate access to gain Azure role assignment rights across every subscription. When no built-in role fits, a custom role definition lists control-plane operations in its Actions and NotActions properties and data-plane operations, such as reading and writing blob data inside a storage container, in its DataActions property. You define custom roles in JSON and can assign them at any scope from management group to resource. Expect scenarios that ask which role, property or scope fits.
Assignment = principal + role definition + scope, inherited downward. Read-only audit = Reader. Data-plane permissions live in DataActions, not Actions. Azure RBAC manages resources; Entra roles manage the directory.
Practice questions
1. In a custom RBAC role definition, which property lists the management (control-plane) operations the role is allowed to perform?
- Actions (correct answer)
- AssignableScopes, which instead defines where in the hierarchy the role can be assigned
- Description
- Name
The Actions array lists the allowed control-plane operations; NotActions subtracts from them and DataActions covers data-plane operations. AssignableScopes only limits where the role can be assigned, while Description and Name are metadata.
2. You want a Reader assignment to apply to every resource in one resource group but nowhere else. At which scope should you assign it?
- The resource group (correct answer)
- The management group that sits above the subscription containing that resource group
- The subscription
- Each resource one by one
RBAC assignments are inherited downward, so a role at the resource group applies to all resources inside it and nothing above. A management group or subscription scope would be too broad, and per-resource assignment is unnecessary work.
3. A user must fully manage all resources in a resource group but must not be able to grant other people access to it. Which built-in role fits best?
- Contributor (correct answer)
- Owner, because it delivers complete control over the resources and also lets the holder assign any role to anyone else
- Reader
- User Access Administrator
Contributor can create and manage every type of resource but cannot grant access, since it excludes Microsoft.Authorization write operations. Owner adds the ability to assign roles, Reader is view-only, and User Access Administrator only manages access.
4. Which built-in role lets a person view every resource in a subscription but change nothing?
- Reader (correct answer)
- Contributor, which additionally allows creating, updating and deleting resources across the whole subscription
- Owner
- User Access Administrator
Reader grants view-only access to resources without any write permission. Contributor and Owner both allow changes, and User Access Administrator manages who can access resources rather than viewing them.
5. A security team must assign and remove roles for others across a subscription but should not manage the resources themselves. Which least-privilege role fits?
- User Access Administrator (correct answer)
- Owner, since granting it provides both full management of every resource and the ability to control access assignments for everyone
- Contributor
- Reader
User Access Administrator can manage user access to Azure resources (assign and remove roles) without permission to manage the resources, matching least privilege. Owner is broader than needed, Contributor cannot assign roles, and Reader cannot either.
6. A role assignment in Azure RBAC is made up of exactly three parts. Which set correctly lists them?
- Security principal, role definition, and scope (correct answer)
- The tenant identifier, the billing account owner, and a list of every subscription that exists in the directory today
- Subnet, route table, and NSG
- Region, SKU, and tag
A role assignment binds a security principal (who) to a role definition (what) at a scope (where). The other options mix in unrelated networking, billing, or resource attributes.