Built-in roles (Owner, Contributor, Reader) in Azure - Step-by-Step Execution

Process Flow - Built-in roles (Owner, Contributor, Reader)

Assign Role to User

↓

Check Role Type

↓

Owner

↓

Full Control

↓

Access Granted Based on Role

Assign a built-in role to a user, then the system checks the role type and grants permissions accordingly.

Execution Sample

Azure

AssignRole(user, role)
CheckRoleType(role)
GrantPermissions(user, permissions)

Assigns a built-in role to a user and grants permissions based on the role type.

Process Table

Step	Action	Input	Role Type	Permissions Granted
1	Assign role to user	User: Alice, Role: Owner	Owner	Full control over resources
2	Assign role to user	User: Bob, Role: Contributor	Contributor	Can create, manage, and delete resources
3	Assign role to user	User: Carol, Role: Reader	Reader	Can view resources only
4	Check role type for Dave	User: Dave, Role: Unknown	None	No permissions granted
5	End	No more assignments	-	-

💡 All role assignments processed; users have permissions based on their roles.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
User	None	Alice	Bob	Carol	Dave	All users assigned
Role	None	Owner	Contributor	Reader	Unknown	Roles assigned or unknown
Permissions	None	Full control	Modify resources	View only	None	Permissions set per user

Key Moments - 3 Insights

Why does the Reader role only allow viewing and not modifying resources?

Because the Reader role is designed with view-only permissions, as shown in execution_table row 3, it grants no rights to change resources.

What happens if a user is assigned a role that is not recognized?

As seen in execution_table row 4, if the role is unknown, no permissions are granted to the user.

Can a Contributor delete resources like an Owner?

Yes, Contributors can create, manage, and delete resources; Owners have full control including managing access (assigning roles), as shown in execution_table rows 1 and 2.

Visual Quiz - 3 Questions

Look at the execution_table, what permissions does Bob have after step 2?

A Full control over resources

B Can view resources only

C Can create and manage resources

D No permissions granted

💡 Hint

Check the 'Permissions Granted' column in row 2 of the execution_table.

At which step does a user get no permissions due to an unknown role?

A Step 1

B Step 4

C Step 2

D Step 3

💡 Hint

Look at the 'Role Type' and 'Permissions Granted' columns in the execution_table.

If Carol was assigned the Contributor role instead of Reader, how would her permissions change?

A She would be able to create and manage resources

B She would have no permissions

C She would have full control over resources

D She would only view resources

💡 Hint

Compare permissions for Contributor and Reader roles in the execution_table rows 2 and 3.

Concept Snapshot

Built-in roles control access in Azure:
- Owner: Full control, including managing access
- Contributor: Can create and manage resources but not assign roles
- Reader: Can only view resources
Assign roles to users to grant permissions accordingly.

Full Transcript

This visual execution shows how Azure built-in roles Owner, Contributor, and Reader grant different permissions to users. When a role is assigned, the system checks the role type and grants permissions: Owner has full control, Contributor can create and manage resources, and Reader can only view. If a role is unknown, no permissions are granted. The execution table tracks each step of role assignment and permission granting, while the variable tracker shows how user, role, and permissions change over time. Key moments clarify common confusions about role capabilities. The quiz tests understanding by referencing the execution steps and permissions.

Practice

1. Which built-in Azure role allows a user to manage resources but not change access permissions?

easy

A. Contributor

B. Owner

C. Reader

D. User Access Administrator

Solution

1. Step 1: Understand role permissions

   The Owner role can manage resources and access control, Contributor can manage resources but not access, Reader can only view.

2. Step 2: Match role to permission

   Since the question asks for managing resources without access control, Contributor fits this description.

3. Final Answer:

   Contributor -> Option A

4. Quick Check:

   Manage resources without access control = Contributor [OK]

Hint: Contributor manages resources but not access rights [OK]

Common Mistakes:

• Confusing Owner with Contributor
• Thinking Reader can manage resources
• Assuming User Access Administrator manages resources

2. Which of the following is the correct way to describe the Reader role in Azure?

easy

A. Can manage resources and access permissions

B. Can only view resources without making changes

C. Can create and delete resources but not assign roles

D. Can assign roles but not manage resources

Solution

1. Step 1: Recall Reader role capabilities

   The Reader role is designed to allow viewing resources only, no changes allowed.

2. Step 2: Match description to Reader

   Can only view resources without making changes correctly states Reader can only view resources without changes.

3. Final Answer:

   Can only view resources without making changes -> Option B

4. Quick Check:

   Reader role = View only [OK]

Hint: Reader role only views resources, no edits allowed [OK]

Common Mistakes:

• Thinking Reader can edit resources
• Confusing Reader with Contributor
• Assuming Reader can assign roles

3. If a user is assigned the Owner role on a resource group, what actions can they perform? Select the best description.

medium

A. View resources only

B. Manage resources but cannot assign roles

C. Manage resources and assign access roles

D. Assign roles but cannot manage resources

Solution

1. Step 1: Understand Owner role permissions

   The Owner role has full access including managing resources and assigning roles.

2. Step 2: Compare options to Owner capabilities

   Manage resources and assign access roles correctly states Owner can manage resources and assign access roles.

3. Final Answer:

   Manage resources and assign access roles -> Option C

4. Quick Check:

   Owner role = Full control including access management [OK]

Hint: Owner role has full control including access rights [OK]

Common Mistakes:

• Confusing Owner with Contributor
• Thinking Owner cannot assign roles
• Assuming Owner can only view

4. A user with Contributor role tries to assign a new role to another user but gets an error. What is the most likely cause?

medium

A. Contributor role does not have permission to assign roles

B. Contributor role cannot manage resources

C. Contributor role can only view resources

D. Contributor role can assign roles only at subscription level

Solution

1. Step 1: Review Contributor role permissions

   Contributor can manage resources but cannot assign roles or change access permissions.

2. Step 2: Identify cause of error

   Since assigning roles requires access management permission, Contributor role lacks this, causing the error.

3. Final Answer:

   Contributor role does not have permission to assign roles -> Option A

4. Quick Check:

   Contributor cannot assign roles = Permission denied error [OK]

Hint: Contributor cannot assign roles, only Owner can [OK]

Common Mistakes:

• Assuming Contributor can assign roles
• Confusing view-only with Contributor
• Thinking Contributor can assign roles at subscription only

5. You want to give a team member full control over a resource group, including managing resources and access permissions. Which built-in role should you assign?

hard

A. Reader

B. User Access Administrator

C. Contributor

D. Owner

Solution

1. Step 1: Define required permissions

   Full control means managing resources and access permissions.

2. Step 2: Match role to permissions

   Owner role includes both managing resources and access control, fitting the requirement.

3. Step 3: Exclude other roles

   Reader only views, Contributor manages resources but not access, User Access Administrator manages access but not resources.

4. Final Answer:

   Owner -> Option D

5. Quick Check:

   Full control = Owner role [OK]

Hint: Owner role grants full control including access management [OK]

Common Mistakes:

• Choosing Contributor for full control
• Confusing User Access Administrator with Owner
• Assuming Reader can manage access