Built-in roles (Owner, Contributor, Reader) in Azure - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the main permission level of the Owner role in Azure?

The Owner role has full access to all resources, including the ability to delegate access to others.

beginner

Which Azure built-in role allows you to manage resources but not assign roles to others?

The Contributor role allows managing resources but does not allow assigning roles or managing access.

beginner

What can a Reader role do in Azure?

The Reader role can view resources but cannot make any changes or manage access.

intermediate

Why is it important to assign the Reader role instead of Contributor when only viewing access is needed?

Assigning Reader limits risk by preventing accidental changes while allowing users to see resource details.

beginner

Can the Owner role assign the Contributor role to another user?

Yes, the Owner role can assign any role, including Contributor, because it has full access and permission management.

Which Azure role can manage resources and assign roles to others?

A Owner

B Contributor

C Reader

D User Access Administrator

The Owner role has full permissions including managing resources and assigning roles.

What is the main limitation of the Contributor role compared to the Owner?

A Cannot assign roles to others

B Cannot view resources

C Cannot create resources

D Cannot delete resources

Contributors can manage resources but cannot assign roles or manage access.

Which role should you assign to someone who only needs to see resource details without making changes?

A Contributor

B Reader

C Owner

D Administrator

The Reader role allows viewing resources without permission to change anything.

True or False: The Reader role can delete resources.

A True

B Only on certain resource types

C Only if granted extra permissions

D False

The Reader role cannot delete or modify resources; it is view-only.

Who can assign the Owner role to another user?

A Contributor

B Reader

C Owner

D Anyone

Only someone with Owner permissions can assign the Owner role to others.

Explain the differences between the Owner, Contributor, and Reader roles in Azure.

Think about what each role can do with resources and permissions.

Why is it a best practice to assign the least privilege role needed, such as Reader instead of Contributor?

Consider the principle of least privilege in security.

Practice

1. Which built-in Azure role allows a user to manage resources but not change access permissions?

easy

A. Contributor

B. Owner

C. Reader

D. User Access Administrator

Solution

1. Step 1: Understand role permissions

   The Owner role can manage resources and access control, Contributor can manage resources but not access, Reader can only view.

2. Step 2: Match role to permission

   Since the question asks for managing resources without access control, Contributor fits this description.

3. Final Answer:

   Contributor -> Option A

4. Quick Check:

   Manage resources without access control = Contributor [OK]

Hint: Contributor manages resources but not access rights [OK]

Common Mistakes:

• Confusing Owner with Contributor
• Thinking Reader can manage resources
• Assuming User Access Administrator manages resources

2. Which of the following is the correct way to describe the Reader role in Azure?

easy

A. Can manage resources and access permissions

B. Can only view resources without making changes

C. Can create and delete resources but not assign roles

D. Can assign roles but not manage resources

Solution

1. Step 1: Recall Reader role capabilities

   The Reader role is designed to allow viewing resources only, no changes allowed.

2. Step 2: Match description to Reader

   Can only view resources without making changes correctly states Reader can only view resources without changes.

3. Final Answer:

   Can only view resources without making changes -> Option B

4. Quick Check:

   Reader role = View only [OK]

Hint: Reader role only views resources, no edits allowed [OK]

Common Mistakes:

• Thinking Reader can edit resources
• Confusing Reader with Contributor
• Assuming Reader can assign roles

3. If a user is assigned the Owner role on a resource group, what actions can they perform? Select the best description.

medium

A. View resources only

B. Manage resources but cannot assign roles

C. Manage resources and assign access roles

D. Assign roles but cannot manage resources

Solution

1. Step 1: Understand Owner role permissions

   The Owner role has full access including managing resources and assigning roles.

2. Step 2: Compare options to Owner capabilities

   Manage resources and assign access roles correctly states Owner can manage resources and assign access roles.

3. Final Answer:

   Manage resources and assign access roles -> Option C

4. Quick Check:

   Owner role = Full control including access management [OK]

Hint: Owner role has full control including access rights [OK]

Common Mistakes:

• Confusing Owner with Contributor
• Thinking Owner cannot assign roles
• Assuming Owner can only view

4. A user with Contributor role tries to assign a new role to another user but gets an error. What is the most likely cause?

medium

A. Contributor role does not have permission to assign roles

B. Contributor role cannot manage resources

C. Contributor role can only view resources

D. Contributor role can assign roles only at subscription level

Solution

1. Step 1: Review Contributor role permissions

   Contributor can manage resources but cannot assign roles or change access permissions.

2. Step 2: Identify cause of error

   Since assigning roles requires access management permission, Contributor role lacks this, causing the error.

3. Final Answer:

   Contributor role does not have permission to assign roles -> Option A

4. Quick Check:

   Contributor cannot assign roles = Permission denied error [OK]

Hint: Contributor cannot assign roles, only Owner can [OK]

Common Mistakes:

• Assuming Contributor can assign roles
• Confusing view-only with Contributor
• Thinking Contributor can assign roles at subscription only

5. You want to give a team member full control over a resource group, including managing resources and access permissions. Which built-in role should you assign?

hard

A. Reader

B. User Access Administrator

C. Contributor

D. Owner

Solution

1. Step 1: Define required permissions

   Full control means managing resources and access permissions.

2. Step 2: Match role to permissions

   Owner role includes both managing resources and access control, fitting the requirement.

3. Step 3: Exclude other roles

   Reader only views, Contributor manages resources but not access, User Access Administrator manages access but not resources.

4. Final Answer:

   Owner -> Option D

5. Quick Check:

   Full control = Owner role [OK]

Hint: Owner role grants full control including access management [OK]

Common Mistakes:

• Choosing Contributor for full control
• Confusing User Access Administrator with Owner
• Assuming Reader can manage access