Built-in roles (Owner, Contributor, Reader) in Azure - Mini Project: Build & Apply

Assign Azure Built-in Roles to Users

📖 Scenario: You are managing access to an Azure subscription for a small team. You need to assign built-in roles to team members so they have the right permissions to work on resources.The three main roles are Owner, Contributor, and Reader. Each role gives different levels of access.

🎯 Goal: Assign the built-in Azure roles Owner, Contributor, and Reader to specific users by creating role assignment configurations.

📋 What You'll Learn

Create a dictionary with users and their assigned roles

Add a variable for the Azure subscription ID

Write a loop to generate role assignment objects for each user

Complete the role assignment configuration with the subscription scope

💡 Why This Matters

🌍 Real World

Assigning built-in roles is a common task when managing Azure subscriptions to control who can do what with cloud resources.

💼 Career

Understanding role assignments is essential for cloud administrators and engineers to secure and manage access in Azure environments.

1

Create a dictionary of users and their roles

Create a dictionary called user_roles with these exact entries: '[e-mail]': 'Owner', '[e-mail]': 'Contributor', '[e-mail]': 'Reader'.

Azure

# Create the user_roles dictionary with exact entries
# Your code here

Hint

Use curly braces to create a dictionary. Each key is a user email string, and each value is a role string.

2

Add the Azure subscription ID variable

Create a variable called subscription_id and set it to the string '12345678-1234-1234-1234-123456789abc'.

Azure

user_roles = {
    '[e-mail]': 'Owner',
    '[e-mail]': 'Contributor',
    '[e-mail]': 'Reader'
}

# Create the subscription_id variable with the exact string
# Your code here

Hint

Assign the subscription ID as a string to the variable subscription_id.

3

Generate role assignment objects for each user

Create a list called role_assignments that contains dictionaries for each user. Use a for loop with variables user and role to iterate over user_roles.items(). Each dictionary should have keys 'user' and 'role' with the corresponding values.

Azure

user_roles = {
    '[e-mail]': 'Owner',
    '[e-mail]': 'Contributor',
    '[e-mail]': 'Reader'
}

subscription_id = '12345678-1234-1234-1234-123456789abc'

# Create role_assignments list with dictionaries for each user and role
# Your code here

Hint

Start with an empty list. Use a for loop to add a dictionary for each user and role.

4

Complete role assignment configuration with subscription scope

Add a new key 'scope' to each dictionary in role_assignments with the value f"/subscriptions/{subscription_id}". Use a for loop with variable assignment to iterate over role_assignments and update each dictionary.

Azure

user_roles = {
    '[e-mail]': 'Owner',
    '[e-mail]': 'Contributor',
    '[e-mail]': 'Reader'
}

subscription_id = '12345678-1234-1234-1234-123456789abc'

role_assignments = []
for user, role in user_roles.items():
    role_assignments.append({'user': user, 'role': role})

# Add 'scope' key to each assignment with subscription scope
# Your code here

Hint

Use a for loop to add the scope key with the subscription path to each dictionary.

Practice

1. Which built-in Azure role allows a user to manage resources but not change access permissions?

easy

A. Contributor

B. Owner

C. Reader

D. User Access Administrator

Solution

1. Step 1: Understand role permissions

   The Owner role can manage resources and access control, Contributor can manage resources but not access, Reader can only view.

2. Step 2: Match role to permission

   Since the question asks for managing resources without access control, Contributor fits this description.

3. Final Answer:

   Contributor -> Option A

4. Quick Check:

   Manage resources without access control = Contributor [OK]

Hint: Contributor manages resources but not access rights [OK]

Common Mistakes:

• Confusing Owner with Contributor
• Thinking Reader can manage resources
• Assuming User Access Administrator manages resources

2. Which of the following is the correct way to describe the Reader role in Azure?

easy

A. Can manage resources and access permissions

B. Can only view resources without making changes

C. Can create and delete resources but not assign roles

D. Can assign roles but not manage resources

Solution

1. Step 1: Recall Reader role capabilities

   The Reader role is designed to allow viewing resources only, no changes allowed.

2. Step 2: Match description to Reader

   Can only view resources without making changes correctly states Reader can only view resources without changes.

3. Final Answer:

   Can only view resources without making changes -> Option B

4. Quick Check:

   Reader role = View only [OK]

Hint: Reader role only views resources, no edits allowed [OK]

Common Mistakes:

• Thinking Reader can edit resources
• Confusing Reader with Contributor
• Assuming Reader can assign roles

3. If a user is assigned the Owner role on a resource group, what actions can they perform? Select the best description.

medium

A. View resources only

B. Manage resources but cannot assign roles

C. Manage resources and assign access roles

D. Assign roles but cannot manage resources

Solution

1. Step 1: Understand Owner role permissions

   The Owner role has full access including managing resources and assigning roles.

2. Step 2: Compare options to Owner capabilities

   Manage resources and assign access roles correctly states Owner can manage resources and assign access roles.

3. Final Answer:

   Manage resources and assign access roles -> Option C

4. Quick Check:

   Owner role = Full control including access management [OK]

Hint: Owner role has full control including access rights [OK]

Common Mistakes:

• Confusing Owner with Contributor
• Thinking Owner cannot assign roles
• Assuming Owner can only view

4. A user with Contributor role tries to assign a new role to another user but gets an error. What is the most likely cause?

medium

A. Contributor role does not have permission to assign roles

B. Contributor role cannot manage resources

C. Contributor role can only view resources

D. Contributor role can assign roles only at subscription level

Solution

1. Step 1: Review Contributor role permissions

   Contributor can manage resources but cannot assign roles or change access permissions.

2. Step 2: Identify cause of error

   Since assigning roles requires access management permission, Contributor role lacks this, causing the error.

3. Final Answer:

   Contributor role does not have permission to assign roles -> Option A

4. Quick Check:

   Contributor cannot assign roles = Permission denied error [OK]

Hint: Contributor cannot assign roles, only Owner can [OK]

Common Mistakes:

• Assuming Contributor can assign roles
• Confusing view-only with Contributor
• Thinking Contributor can assign roles at subscription only

5. You want to give a team member full control over a resource group, including managing resources and access permissions. Which built-in role should you assign?

hard

A. Reader

B. User Access Administrator

C. Contributor

D. Owner

Solution

1. Step 1: Define required permissions

   Full control means managing resources and access permissions.

2. Step 2: Match role to permissions

   Owner role includes both managing resources and access control, fitting the requirement.

3. Step 3: Exclude other roles

   Reader only views, Contributor manages resources but not access, User Access Administrator manages access but not resources.

4. Final Answer:

   Owner -> Option D

5. Quick Check:

   Full control = Owner role [OK]

Hint: Owner role grants full control including access management [OK]

Common Mistakes:

• Choosing Contributor for full control
• Confusing User Access Administrator with Owner
• Assuming Reader can manage access