AZ-900 Microsoft Azure Fundamentals Exam

Describe Azure role-based access control (RBAC)

Core Concepts of Azure RBAC

Azure role-based access control (RBAC) is the main authorization system in Azure that helps manage who can access resources. You grant access by assigning roles to a security principal at a chosen scope. A security principal can be a user, a group, a service principal, or a managed identity. These assignments determine who can do what on Azure resources.

Each role definition is a collection of permissions for operations like read, write, or delete. Azure provides many built-in roles sorted into job function roles (for tasks like managing VMs) and privileged administrator roles (for high-level control). If none of these meets your needs, you can create custom roles to follow the principle of least privilege. Always select the most restrictive role that allows required actions.

A role assignment links a role to a principal within a specific scope. Azure scopes are organized in a hierarchy: management group, subscription, resource group, and resource. Roles at a higher level automatically apply to all child scopes, enabling inheritance of permissions and simplifying access management.

Azure RBAC uses an additive model for permissions, meaning a user’s effective permissions are the union of all their role assignments. If a deny assignment exists, it overrides any allow permissions, highlighting the importance of deny rules. To decide if an action is allowed, Azure evaluates a series of steps: acquiring a token for Azure Resource Manager, retrieving assignments and any deny assignments for the requested resource, narrowing to role assignments for the principal (including transitive group memberships) and determining if the action is covered, and evaluating any conditions on the role assignment. This evaluation ensures secure and consistent access across all Azure resources.

Role Assignments and Scopes

Azure RBAC assigns roles to users, groups, and service principals at different scopes. A role assignment consists of three elements: a security principal, a role definition, and a scope. The security principal is the entity that needs access, the role definition is the set of permissions, and the scope determines where the assignment applies—such as a management group, subscription, resource group, or individual resource.

Scopes in Azure RBAC are hierarchical. Permissions assigned at a higher level, like a subscription, are inherited by lower levels, such as resource groups or individual resources. This inheritance allows efficient management of access across multiple resources. For example, if a role is assigned at the subscription level, it automatically applies to all resource groups and resources within that subscription unless explicitly overridden.

Understanding scope inheritance is crucial. When a role is assigned at a broader scope, it cascades down to all contained resources. This means that if a user is granted a role at the subscription level, they automatically have the same permissions for all resources within that subscription. However, specific role assignments can be made at lower levels to tailor access as needed.

To manage access efficiently, follow best practices such as assigning roles at the lowest scope necessary to minimize the risk of over-permissioning. Regularly reviewing role assignments and scopes helps ensure that access remains appropriate as organizational needs evolve. Using built-in roles whenever possible simplifies management and reduces the complexity of custom role definitions.

Roles and Role Definitions

Azure RBAC uses role definitions (sets of permissions) and role assignments (linking a security principal to a role) at a particular scope. The key components are the role definition, the security principal, the scope, and the role assignment. Understanding these components helps ensure resources are accessed securely and with the right level of permissions.

To assign a role, you first identify a security principal who needs access. A security principal can be a user (an individual with a Microsoft Entra ID profile), a group (a collection of users that inherits the same role), a service principal (an identity for applications or services to authenticate), or a managed identity (an automatically managed identity by Azure for cloud applications).

Permissions are grouped into role definitions, commonly called roles, and are organized into two categories. Job function roles let users manage specific resources, like the Virtual Machine Contributor or Storage Blob Data Reader. Privileged administrator roles grant high-level rights, such as Owner, which includes the ability to assign roles to others.

When the built-in roles don’t match your organization’s needs, you can create custom roles. Custom roles let you pick specific Actions and DataActions to grant or deny. You define which operations a role can perform and then assign it to a security principal at the desired scope. This approach ensures that users get exactly the permissions they need—no more, no less.

Roles can be assigned at multiple scopes, from management group down to individual resources. Scopes follow a parent-child inheritance model, so a role at a higher level applies to all resources under it. Group membership is transitive, meaning nested groups inherit role assignments. Because Azure RBAC uses an additive model, a user’s effective permissions are the sum of all their role assignments across scopes.

Best Practices for Implementing RBAC

Implementing RBAC effectively ensures that users have the appropriate permissions to perform their tasks without compromising security. One key best practice is the principle of least privilege, which means granting users only the permissions they need to perform their job functions, and nothing more. By limiting access, organizations can reduce the risk of unauthorized actions and potential security breaches. It’s important to regularly review and adjust permissions as roles and responsibilities change.

Another best practice is conducting a regular review of role assignments. This involves periodically checking who has access to what resources and ensuring that permissions are still appropriate. Regular reviews help identify and remove unnecessary access, which can prevent potential security vulnerabilities. Establishing a routine schedule for these reviews is crucial to maintaining a secure environment.

The use of Azure Policy is essential in enforcing RBAC policies. Azure Policy allows organizations to create and manage policies that ensure resources comply with corporate standards and service level agreements. By using Azure Policy, administrators can automate compliance checks and enforce rules consistently across the Azure environment, enhancing security and governance.

In summary, implementing RBAC in Azure requires careful planning and ongoing management. By adhering to the principle of least privilege, conducting regular reviews of role assignments, and utilizing Azure Policy, organizations can effectively manage access to resources while maintaining a secure and compliant environment.

Monitoring and Auditing RBAC

Effective monitoring and auditing of Azure RBAC helps ensure that only authorized users can perform actions on resources. Azure Monitor and the Azure Activity Log capture events related to role assignments, such as creations, updates, and deletions. Use these logs to track who changed what, when, and where. Regular review of these logs supports compliance and security best practices.

In the Azure portal, the Access control (IAM) blade provides a central view of role assignments. The Role assignments tab lists who has access at each scope—management group, subscription, resource group, or resource. Use the Check access feature to audit specific users, groups, service principals, or managed identities. You can also export this view for offline analysis.

Azure CLI and PowerShell offer commands to automate audits. For example, az role assignment list shows current assignments, and az role assignment list-changelogs retrieves history of changes. Get-AzRoleAssignment lists assignments in PowerShell. Combine these with the Azure Activity Log to see detailed events for role assignment creations and deletions.

Azure Security Center strengthens auditing by flagging overly permissive roles and recommending remediation steps. It highlights scenarios where users have excessive permissions, helping you apply the Principle of Least Privilege. To remediate, review flagged assignments, remove or adjust roles, and implement time-bound or eligible assignments for critical roles.

Continuous monitoring and proactive auditing of Azure RBAC configurations reduce security risks and maintain compliance. By leveraging Azure Monitor, Azure Activity Log, and Azure Security Center, you can identify potential issues early and ensure that access remains aligned with organizational requirements.