Azure Governance and RBAC
Two systems are easy to confuse and both appear in the same questions. RBAC controls who may do something. Policy controls what may exist. A question that says a compliant user cannot create a resource is usually a policy question.
Azure Governance and RBAC · firsttry.app/cheatsheets/azure-governance-rbac · original reference written from published exam objectives. Not affiliated with any certification body.
Built-in roles
| Role | What it allows |
|---|---|
| Owner | Everything, including granting access to others |
| Contributor | Everything except granting access |
| Reader | View only |
| User Access Administrator | Manage access, nothing else |
| Virtual Machine Contributor | Manage VMs, not the VNet or storage they use |
| Storage Blob Data Contributor | Read and write blob data. A data plane role |
| Network Contributor | Manage networking resources |
| Security Reader / Admin | View or manage security settings |
Scope and inheritance
| Level | Detail |
|---|---|
| Management group | Top. Groups subscriptions, inherits downward |
| Subscription | Inherits from management group |
| Resource group | Inherits from subscription |
| Resource | Inherits from resource group |
| Rule | Assignments are additive down the tree |
| Deny assignment | Overrides an allow. Created by Azure, not by hand |
| Maximum assignments | Limited per subscription. Use groups, not individual users |
RBAC against Policy
| Question | RBAC | Azure Policy |
|---|---|---|
| What does it control | Who may perform an action | What configuration is permitted |
| Typical failure | Permission denied on a request | Resource creation blocked by a policy |
| Effects available | Allow only, plus deny assignments | Deny, Audit, Append, Modify, DeployIfNotExists |
| Example | Grant Contributor on one resource group | Require a tag, or block a region |
Locks and cost controls
| Feature | What it does |
|---|---|
| CanNotDelete lock | Read and modify permitted, delete blocked |
| ReadOnly lock | Read permitted, everything else blocked |
| Lock inheritance | Applies to everything below the scope it is set at |
| Lock precedence | The most restrictive lock in the chain wins |
| Tags | Key and value pairs for cost allocation and automation |
| Budgets | Alerts at a spending threshold. Does not stop spend |
| Resource graph | Query resources across subscriptions at speed |
Try it here
Three verified practice questions on this material. Answer one, and see the official page behind the answer.
Monitor and maintain Azure resources
What is the longest the soft delete retention period for backup data can be extended to?
Manage security operations
A SOC needs alerts from many detections grouped into one case that an analyst can own and investigate. What does Microsoft Sentinel produce from correlated alerts?
Plan and automate identity governance
Who should be engaged to confirm that people still need access to a resource?
Five free questions on every practice exam. No account, no card.