Whoever wants to view or change something in Azure needs a role at a scope. Administration mostly means two things: granting rights as narrowly as possible, and, when asked "Who may do what?", reading the answer from a list of assignments. This lesson practices both.
Nordlicht Reisen GmbH, a fictional travel agency, has the resource groups buchung and marketing. The audit team is supposed to read, marketing is supposed to work in its group, and IT is supposed to be able to explain within a minute, in case of a complaint, why someone may do something.
Prior knowledge: What Azure RBAC is, which three parts an assignment consists of, and that rights are inherited downward and add up are explained in "AZ-900 compact", lesson 2.6. The five most important roles, the separation of the management plane and the data plane, the group as the carrier of rights, "Check access" and deny assignments are taught in K3, lesson 3.1.4. Here you learn how to find, assign and read roles the way the exam requires. The directory (users and groups) is lesson 1.1.
Finding and reading built-in roles
Azure has many built-in roles. In the portal, you see them when you open Access control (IAM) at a scope and choose Add, Add role assignment. On the Role tab there are two tabs:
- Job function roles: roles for the general management of resources or for individual services.
- Privileged administrator roles: roles with far-reaching rights, such as Owner, Contributor, User Access Administrator and Role Based Access Control Administrator. Microsoft recommends limiting assignments of these roles.
With the search box you filter by name and description, and further with Type and Category. In the Details column, View shows the role's permissions. The role never says where it applies; that is determined only by the scope of the assignment.
On the command line, you find roles and their definitions like this:
az role definition list --query "[].{name:name, roleType:roleType, roleName:roleName}" --output tsv
az role definition list --name "Reader"
Get-AzRoleDefinition -Name 'Reader'
The first line prints one line per role with identifier, type and name. The second prints the definition as JSON, with the lists actions, notActions, dataActions and notDataActions and assignableScopes. Actions and NotActions apply to the management of resources, DataActions and NotDataActions to the data inside them; NotActions subtracts from Actions again (K3, lesson 3.1.4). Custom roles are possible, but not the topic of this lesson. Up to 5,000 custom roles are allowed per tenant.