Role-Based Access Control (RBAC) in Azure - Commands & Configuration

Introduction

Managing who can do what in your cloud environment is important for security. Role-Based Access Control (RBAC) helps you give the right permissions to the right people or services, so they only access what they need.

When you want to let a team member manage virtual machines but not change network settings.

When you need to give an application permission to read data from a storage account without full access.

When you want to limit access to sensitive resources to only certain users.

When you want to track who has access to what in your Azure subscription.

When you want to follow security best practices by giving least privilege access.

Commands

This command assigns the Reader role to the user with email [e-mail] for the resource group named myResourceGroup. It lets the user view resources but not change them.

Terminal

az role assignment create --assignee [e-mail] --role "Reader" --scope /subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myResourceGroup

Expected Output

{

  "canDelegate": null,

  "id": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myResourceGroup/providers/Microsoft.Authorization/roleAssignments/abcdef12-3456-7890-abcd-ef1234567890",

  "name": "abcdef12-3456-7890-abcd-ef1234567890",

  "principalId": "11111111-2222-3333-4444-555555555555",

  "principalType": "User",

  "roleDefinitionId": "/subscriptions/12345678-1234-1234-1234-123456789abc/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",

  "scope": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myResourceGroup",

  "type": "Microsoft.Authorization/roleAssignments"

}

→

--assignee - Specifies the user or service principal to assign the role to.

→

--role - Defines the role to assign, like Reader, Contributor, or Owner.

→

--scope - Limits the role assignment to a specific resource or group.

This command lists all role assignments for the user [e-mail] within the specified resource group. It helps verify what permissions the user has.

Terminal

az role assignment list --assignee [e-mail] --scope /subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myResourceGroup

Expected Output

[

  {

    "canDelegate": null,

    "id": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myResourceGroup/providers/Microsoft.Authorization/roleAssignments/abcdef12-3456-7890-abcd-ef1234567890",

    "name": "abcdef12-3456-7890-abcd-ef1234567890",

    "principalId": "11111111-2222-3333-4444-555555555555",

    "principalType": "User",

    "roleDefinitionId": "/subscriptions/12345678-1234-1234-1234-123456789abc/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",

    "scope": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myResourceGroup",

    "type": "Microsoft.Authorization/roleAssignments"

  }

]

→

--assignee - Filters the list to show assignments for this user or service principal.

→

--scope - Limits the list to assignments within this resource or group.

This command removes the Reader role assignment from the user [e-mail] for the specified resource group. It revokes their read access.

Terminal

az role assignment delete --assignee [e-mail] --role "Reader" --scope /subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myResourceGroup

Expected Output

No output (command runs silently)

→

--assignee - Specifies the user or service principal whose role assignment will be removed.

→

--role - Specifies which role assignment to remove.

→

--scope - Limits the removal to the specified resource or group.

Key Concept

If you remember nothing else from this pattern, remember: RBAC lets you control who can do what by assigning roles with specific permissions to users or services at the right scope.

Common Mistakes

Assigning a role without specifying the correct scope.

The role might be assigned at a broader or unintended level, giving more access than needed.

Always use the --scope flag to limit the role assignment to the exact resource or group.

Using an incorrect or misspelled role name.

The command will fail because the role does not exist or is not recognized.

Use exact role names like "Reader", "Contributor", or "Owner" and check available roles with az role definition list.

Not verifying role assignments after creating or deleting them.

You might think permissions changed when they did not, leading to confusion or security risks.

Use az role assignment list to confirm the current assignments.

Summary

Use az role assignment create to give a user or service a role with specific permissions at a defined scope.

Use az role assignment list to check what roles a user or service has on resources.

Use az role assignment delete to remove roles and revoke permissions when no longer needed.

Practice

1. What is the main purpose of Role-Based Access Control (RBAC) in Azure?

easy

A. To store data securely

B. To create virtual machines automatically

C. To monitor network traffic

D. To assign permissions to users based on their roles

Solution

1. Step 1: Understand RBAC concept

   RBAC is designed to control who can do what by assigning roles with specific permissions.

2. Step 2: Identify the main function

   Assigning permissions based on roles helps manage access securely and efficiently.

3. Final Answer:

   To assign permissions to users based on their roles -> Option D

4. Quick Check:

   RBAC controls access by roles = A [OK]

Hint: RBAC = roles control permissions [OK]

Common Mistakes:

• Confusing RBAC with resource creation
• Thinking RBAC monitors traffic
• Assuming RBAC stores data

2. Which of the following is the correct way to assign a role to a user in Azure CLI?

easy

A. az role create --user [e-mail] --role Contributor

B. az user assign role --email [e-mail] --role Contributor

C. az role assignment create --assignee [e-mail] --role Contributor --scope /subscriptions/12345

D. az assign role --user [e-mail] --role Contributor

Solution

1. Step 1: Recall Azure CLI syntax for role assignment

   The correct command uses 'az role assignment create' with --assignee, --role, and --scope parameters.

2. Step 2: Match the correct command

   az role assignment create --assignee [e-mail] --role Contributor --scope /subscriptions/12345 matches the correct syntax and parameters for assigning a role.

3. Final Answer:

   az role assignment create --assignee [e-mail] --role Contributor --scope /subscriptions/12345 -> Option C

4. Quick Check:

   Correct CLI syntax = D [OK]

Hint: Use 'az role assignment create' with assignee and scope [OK]

Common Mistakes:

• Using wrong command verbs like 'assign' or 'create' alone
• Missing the --scope parameter
• Incorrect parameter names

3. Given this Azure CLI command:

az role assignment create --assignee [e-mail] --role Reader --scope /subscriptions/12345/resourceGroups/myGroup

What permission level does the user get on the resource group?

medium

A. Read-only access to the resource group

B. Write access to all resources in the subscription

C. Full control over the subscription

D. No access because scope is incorrect

Solution

1. Step 1: Analyze the role and scope

   The role is 'Reader', which grants read-only permissions. The scope is a specific resource group, limiting access to that group.

2. Step 2: Determine permission level

   The user can only read resources inside 'myGroup' resource group, not modify or access other subscription parts.

3. Final Answer:

   Read-only access to the resource group -> Option A

4. Quick Check:

   Reader role + resource group scope = read-only access [OK]

Hint: Reader role means read-only at given scope [OK]

Common Mistakes:

• Assuming Reader grants write or full control
• Confusing subscription scope with resource group scope
• Thinking scope is invalid

4. You tried to assign the 'Owner' role to a user but got an error. Which of these is the most likely cause?

medium

A. You do not have permission to assign the Owner role

B. The user email is invalid

C. The role name 'Owner' does not exist

D. You forgot to specify the subscription ID

Solution

1. Step 1: Understand role assignment permissions

   Assigning the 'Owner' role requires you to have sufficient permissions, usually Owner or User Access Administrator.

2. Step 2: Identify common error causes

   If you lack permission, Azure blocks the assignment with an error. Other options are less likely because 'Owner' is a valid role and subscription ID is often optional if context is set.

3. Final Answer:

   You do not have permission to assign the Owner role -> Option A

4. Quick Check:

   Permission needed to assign Owner role = B [OK]

Hint: Only users with rights can assign Owner role [OK]

Common Mistakes:

• Assuming role name is wrong
• Ignoring permission requirements
• Forgetting subscription context

5. You want to give a service principal permission to manage only virtual machines in a resource group without affecting other resources. Which RBAC role and scope should you assign?

hard

A. Assign 'Contributor' role at the subscription scope

B. Assign 'Virtual Machine Contributor' role at the resource group scope

C. Assign 'Owner' role at the resource group scope

D. Assign 'Reader' role at the virtual machine resource scope

Solution

1. Step 1: Identify the least privilege role for VM management

   'Virtual Machine Contributor' allows managing VMs but not other resources.

2. Step 2: Choose the correct scope

   Assigning at the resource group scope limits permissions to that group only, not the whole subscription.

3. Step 3: Evaluate other options

   'Contributor' at subscription is too broad; 'Owner' is too powerful; 'Reader' only allows viewing, not managing.

4. Final Answer:

   Assign 'Virtual Machine Contributor' role at the resource group scope -> Option B

5. Quick Check:

   Least privilege VM management at resource group = A [OK]

Hint: Use specific role + resource group scope for least privilege [OK]

Common Mistakes:

• Using broad roles like Contributor or Owner unnecessarily
• Assigning at subscription scope when resource group is enough
• Choosing Reader role which lacks management permissions