Bird
Raised Fist0
Azurecloud~5 mins

Built-in roles (Owner, Contributor, Reader) in Azure - Commands & Configuration

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime
Introduction
Azure built-in roles help control who can do what in your cloud resources. They solve the problem of managing permissions easily without creating custom roles.
When you want to give full control of a resource to a team member without restrictions.
When you want someone to manage resources but not change access permissions.
When you want to allow someone to only view resources without making changes.
When you need quick permission setup using predefined roles.
When you want to avoid mistakes by using tested, standard roles.
Commands
Assigns the Owner role to user@example.com for the specified resource group, giving full control including managing access.
Terminal
az role assignment create --assignee user@example.com --role Owner --scope /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup
Expected OutputExpected
{ "canDelegate": false, "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Authorization/roleAssignments/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "name": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "principalId": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy", "principalType": "User", "roleDefinitionId": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635", "roleDefinitionName": "Owner", "scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup", "type": "Microsoft.Authorization/roleAssignments" }
→
--assignee - Specifies the user or service principal to assign the role
→
--role - Specifies the built-in role to assign
→
--scope - Defines the resource or resource group where the role applies
Assigns the Contributor role to user@example.com for the resource group, allowing resource management but not access control.
Terminal
az role assignment create --assignee user@example.com --role Contributor --scope /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup
Expected OutputExpected
{ "canDelegate": false, "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Authorization/roleAssignments/zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz", "name": "zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz", "principalId": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa", "principalType": "User", "roleDefinitionId": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c", "roleDefinitionName": "Contributor", "scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup", "type": "Microsoft.Authorization/roleAssignments" }
→
--assignee - Specifies the user or service principal to assign the role
→
--role - Specifies the built-in role to assign
→
--scope - Defines the resource or resource group where the role applies
Assigns the Reader role to user@example.com for the resource group, allowing only viewing access without changes.
Terminal
az role assignment create --assignee user@example.com --role Reader --scope /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup
Expected OutputExpected
{ "canDelegate": false, "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Authorization/roleAssignments/cccccccc-cccc-cccc-cccc-cccccccccccc", "name": "cccccccc-cccc-cccc-cccc-cccccccccccc", "principalId": "dddddddd-dddd-dddd-dddd-dddddddddddd", "principalType": "User", "roleDefinitionId": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7", "roleDefinitionName": "Reader", "scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup", "type": "Microsoft.Authorization/roleAssignments" }
→
--assignee - Specifies the user or service principal to assign the role
→
--role - Specifies the built-in role to assign
→
--scope - Defines the resource or resource group where the role applies
Lists all role assignments for user@example.com on the specified resource group to verify permissions.
Terminal
az role assignment list --assignee user@example.com --scope /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup
Expected OutputExpected
[ { "principalId": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy", "roleDefinitionName": "Owner", "scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup" } ]
→
--assignee - Filters role assignments by user or service principal
→
--scope - Filters role assignments by resource or resource group
Key Concept

If you remember nothing else from this pattern, remember: Owner can do everything including access control, Contributor can manage resources but not access, and Reader can only view resources.

Common Mistakes
Assigning Contributor role when Owner role is needed for access control.
Contributor cannot change permissions, so the user cannot grant access to others.
Use Owner role if the user needs to manage access permissions.
Using incorrect scope that is too broad or too narrow.
Permissions may apply to unintended resources or not apply where needed.
Specify the exact resource group or resource scope where permissions are required.
Not verifying role assignments after creation.
You may think permissions are set but they are not, causing access issues.
Run az role assignment list to confirm the user has the expected roles.
Summary
Use az role assignment create to assign built-in roles Owner, Contributor, or Reader to users.
Owner role allows full control including managing access, Contributor allows resource management without access control, Reader allows only viewing.
Verify role assignments with az role assignment list to ensure correct permissions.

Practice

(1/5)
1. Which built-in Azure role allows a user to manage resources but not change access permissions?
easy
A. Contributor
B. Owner
C. Reader
D. User Access Administrator

Solution

  1. Step 1: Understand role permissions

    The Owner role can manage resources and access control, Contributor can manage resources but not access, Reader can only view.

  2. Step 2: Match role to permission

    Since the question asks for managing resources without access control, Contributor fits this description.

  3. Final Answer:

    Contributor -> Option A

  4. Quick Check:

    Manage resources without access control = Contributor [OK]
Hint: Contributor manages resources but not access rights [OK]
Common Mistakes:
  • Confusing Owner with Contributor
  • Thinking Reader can manage resources
  • Assuming User Access Administrator manages resources
2. Which of the following is the correct way to describe the Reader role in Azure?
easy
A. Can manage resources and access permissions
B. Can only view resources without making changes
C. Can create and delete resources but not assign roles
D. Can assign roles but not manage resources

Solution

  1. Step 1: Recall Reader role capabilities

    The Reader role is designed to allow viewing resources only, no changes allowed.

  2. Step 2: Match description to Reader

    Can only view resources without making changes correctly states Reader can only view resources without changes.

  3. Final Answer:

    Can only view resources without making changes -> Option B

  4. Quick Check:

    Reader role = View only [OK]
Hint: Reader role only views resources, no edits allowed [OK]
Common Mistakes:
  • Thinking Reader can edit resources
  • Confusing Reader with Contributor
  • Assuming Reader can assign roles
3. If a user is assigned the Owner role on a resource group, what actions can they perform? Select the best description.
medium
A. View resources only
B. Manage resources but cannot assign roles
C. Manage resources and assign access roles
D. Assign roles but cannot manage resources

Solution

  1. Step 1: Understand Owner role permissions

    The Owner role has full access including managing resources and assigning roles.

  2. Step 2: Compare options to Owner capabilities

    Manage resources and assign access roles correctly states Owner can manage resources and assign access roles.

  3. Final Answer:

    Manage resources and assign access roles -> Option C

  4. Quick Check:

    Owner role = Full control including access management [OK]
Hint: Owner role has full control including access rights [OK]
Common Mistakes:
  • Confusing Owner with Contributor
  • Thinking Owner cannot assign roles
  • Assuming Owner can only view
4. A user with Contributor role tries to assign a new role to another user but gets an error. What is the most likely cause?
medium
A. Contributor role does not have permission to assign roles
B. Contributor role cannot manage resources
C. Contributor role can only view resources
D. Contributor role can assign roles only at subscription level

Solution

  1. Step 1: Review Contributor role permissions

    Contributor can manage resources but cannot assign roles or change access permissions.

  2. Step 2: Identify cause of error

    Since assigning roles requires access management permission, Contributor role lacks this, causing the error.

  3. Final Answer:

    Contributor role does not have permission to assign roles -> Option A

  4. Quick Check:

    Contributor cannot assign roles = Permission denied error [OK]
Hint: Contributor cannot assign roles, only Owner can [OK]
Common Mistakes:
  • Assuming Contributor can assign roles
  • Confusing view-only with Contributor
  • Thinking Contributor can assign roles at subscription only
5. You want to give a team member full control over a resource group, including managing resources and access permissions. Which built-in role should you assign?
hard
A. Reader
B. User Access Administrator
C. Contributor
D. Owner

Solution

  1. Step 1: Define required permissions

    Full control means managing resources and access permissions.

  2. Step 2: Match role to permissions

    Owner role includes both managing resources and access control, fitting the requirement.

  3. Step 3: Exclude other roles

    Reader only views, Contributor manages resources but not access, User Access Administrator manages access but not resources.

  4. Final Answer:

    Owner -> Option D

  5. Quick Check:

    Full control = Owner role [OK]
Hint: Owner role grants full control including access management [OK]
Common Mistakes:
  • Choosing Contributor for full control
  • Confusing User Access Administrator with Owner
  • Assuming Reader can manage access
Recommended

Ready to prove it?

Pass the test and this pattern moves unknown strong while earning +1 Grip toward your certificate.

10 questions~5 mineasy hard