Azure IAM – Important Rules and Definitions (AZ-104)

Reader

Can view resources but cannot modify them.

Contributor

Can create, update, and delete resources but cannot assign Azure RBAC roles by default.

Owner

Can manage resources and assign Azure RBAC roles.

User Access Administrator

Can manage access to Azure resources by assigning roles, subject to its permissions.

Role Based Access Control Administrator

Can manage Azure RBAC role assignments within its permitted scope and conditions.

Global Administrator

Manages Microsoft Entra ID but does not automatically have access to all Azure resources.

Custom Role

A user-defined role containing specific permissions.

Built-in Role

A predefined Azure role with a fixed set of permissions.

Deny Assignment

Blocks specified actions even when a role assignment would otherwise allow them, subject to Azure rules.

IAM

Interface in the Azure portal for managing access to Azure resources.

Azure RBAC

Controls what actions identities can perform on Azure resources.

Principal

Identity receiving permissions, such as a user, group, service principal, or managed identity.

Role Definition

Specifies the permissions included in a role.

Scope

Defines the level at which permissions apply.

Role Assignment

Connects a principal, a role, and a scope.

Least Privilege

Grant only the permissions required to perform a task.

Group-Based Access

Assign roles to a group to manage access for multiple users centrally.

Multiple Role Assignments

Permissions from multiple applicable role assignments are generally combined, subject to restrictions.

Remove Role Assignment

Removes permissions granted by that assignment; other assignments may still provide access.

Management Group

Permissions can apply to subscriptions and resources within the management group hierarchy.

Subscription

Permissions can apply to all resources within the subscription.

Resource Group

Permissions can apply to the resource group and its resources.

Resource

Permissions apply to a specific resource.

Scope Inheritance

Permissions assigned at a parent scope generally flow down to child scopes.

Narrowest Scope

Assign permissions at the lowest scope that meets the requirement.

Resource-Level Assignment

Access to one resource does not automatically grant access to other resources in the same resource group.

Microsoft Entra ID

Manages identities and authentication for users, groups, and applications.

Managed Identity

Allows a supported Azure resource to authenticate to other services without manually managing credentials.

System-Assigned Identity

Identity lifecycle is tied to one Azure resource.

User-Assigned Identity

Standalone identity that can be assigned to multiple supported Azure resources.

Service Principal

Application identity used to access resources.

Entra ID Group

Collection of identities that can receive permissions through group-based role assignments.

MFA

Requires additional verification beyond a single authentication factor.

Conditional Access

Applies access policies based on conditions such as user, location, device, and risk.

PIM

Provides just-in-time and time-limited activation of privileged access.

Check Access

Shows a principal's effective access and relevant role assignments at a selected scope.

Add Role Assignment

Grants a role to a principal when the assigning identity has sufficient permissions.

Permission Propagation

Role assignment changes may take several minutes to become effective.

Azure Policy

Enforces resource configuration and compliance rules.

Resource Locks

Help prevent deletion or modification of locked resources.

Reader vs Contributor

Reader views resources; Contributor manages resources but cannot grant Azure RBAC access by default.

Owner vs User Access Administrator

Owner manages resources and access; User Access Administrator manages access but does not inherently grant general resource-management permissions.

Azure RBAC vs Kubernetes RBAC

Azure RBAC controls Azure resources; Kubernetes RBAC controls Kubernetes API resources.

Access Denied

Check role, principal, scope, deny assignments, conditions, and service-specific permissions.

Azure Resource Manager (ARM)

Management layer used to deploy and manage Azure resources.

Control Plane

Handles resource operations such as creating, updating, and deleting resources.

Data Plane

Provides access to data inside a resource, such as blobs or database records.

Control Plane Permissions

Permission to manage a resource does not necessarily grant access to its data.

Storage Blob Data Reader

Can read blob data within the assigned scope.

Storage Blob Data Contributor

Can read, write, and delete blob data within the assigned scope.

Storage Blob Data Owner

Has broad control over blob data, including ownership-related permissions.

Subscription-Level Assignment

Permissions generally apply to child resource groups and resources.

Data-Plane Role

May be required separately to access data even when resource-management access exists.

Explicit Deny

A deny assignment can block specified actions despite otherwise applicable permissions.