Custom role definitions in Azure - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a custom role definition in Azure?

A custom role definition is a set of permissions that you create to control access to Azure resources. It lets you specify exactly what actions users can perform.

beginner

Which JSON property defines the actions allowed in a custom role?

The actions property lists the operations that are allowed by the role, such as reading or writing resources.

intermediate

Why use custom roles instead of built-in roles in Azure?

Custom roles let you tailor permissions to your exact needs, avoiding giving too many or too few rights compared to built-in roles.

intermediate

What is the purpose of the notActions property in a custom role definition?

The notActions property lists actions that are excluded from the allowed actions. It helps refine permissions by denying specific operations.

beginner

How do you assign a custom role to a user in Azure?

You assign a custom role by creating a role assignment that links the role definition to a user, group, or service principal at a specific scope.

What JSON property specifies the scope of a custom role definition?

A roleScope

B scope

C assignableScopes

D resourceScope

The assignableScopes property defines where the custom role can be assigned, such as a subscription or resource group.

Which property in a custom role definition contains the role's unique identifier?

A roleName

B roleId

C name

D id

The id property holds the unique identifier (GUID) for the role definition.

What is the minimum required property to create a valid custom role definition?

A actions

B assignableScopes

C roleName

D description

The assignableScopes property is required to specify where the role can be assigned.

Which of these is NOT a valid action in a custom role definition?

A Microsoft.FakeService/fakeAction

B Microsoft.Compute/virtualMachines/start/action

C Microsoft.Network/virtualNetworks/delete

D Microsoft.Storage/storageAccounts/read

Actions must be valid Azure resource provider operations. "Microsoft.FakeService/fakeAction" is not a real Azure action.

How can you prevent a custom role from allowing a specific action?

A Add it to notActions

B Add it to assignableScopes

C Remove it from actions

D Set it in description

The notActions property excludes specific actions from the allowed actions.

Explain the key components of an Azure custom role definition JSON and their purposes.

Think about what permissions are allowed, denied, and where the role applies.

Describe the process to create and assign a custom role in Azure.

Consider the steps from writing the role to giving it to someone.