Azure Governance and RBAC
Two systems are easy to confuse and both appear in the same questions. RBAC controls who may do something. Policy controls what may exist. A question that says a compliant user cannot create a resource is usually a policy question.
Azure Governance and RBAC · firsttry.app/cheatsheets/azure-governance-rbac · original reference written from published exam objectives. Not affiliated with any certification body.
Built-in roles
| Role | What it allows |
|---|---|
| Owner | Everything, including granting access to others |
| Contributor | Everything except granting access |
| Reader | View only |
| User Access Administrator | Manage access, nothing else |
| Virtual Machine Contributor | Manage VMs, not the VNet or storage they use |
| Storage Blob Data Contributor | Read and write blob data. A data plane role |
| Network Contributor | Manage networking resources |
| Security Reader / Admin | View or manage security settings |
Scope and inheritance
| Level | Detail |
|---|---|
| Management group | Top. Groups subscriptions, inherits downward |
| Subscription | Inherits from management group |
| Resource group | Inherits from subscription |
| Resource | Inherits from resource group |
| Rule | Assignments are additive down the tree |
| Deny assignment | Overrides an allow. Created by Azure, not by hand |
| Maximum assignments | Limited per subscription. Use groups, not individual users |
RBAC against Policy
| Question | RBAC | Azure Policy |
|---|---|---|
| What does it control | Who may perform an action | What configuration is permitted |
| Typical failure | Permission denied on a request | Resource creation blocked by a policy |
| Effects available | Allow only, plus deny assignments | Deny, Audit, Append, Modify, DeployIfNotExists |
| Example | Grant Contributor on one resource group | Require a tag, or block a region |
Locks and cost controls
| Feature | What it does |
|---|---|
| CanNotDelete lock | Read and modify permitted, delete blocked |
| ReadOnly lock | Read permitted, everything else blocked |
| Lock inheritance | Applies to everything below the scope it is set at |
| Lock precedence | The most restrictive lock in the chain wins |
| Tags | Key and value pairs for cost allocation and automation |
| Budgets | Alerts at a spending threshold. Does not stop spend |
| Resource graph | Query resources across subscriptions at speed |
Now test yourself
Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.