Azure RBAC: Built-in Roles & Custom Role JSON

Implement fine-grained Azure Role-Based Access Control (RBAC), least-privilege scoping, and author custom role definitions using Azure PowerShell and Azure CLI.

Tags:#Azure#RBAC#Access Control#Custom Roles#Governance#AZ-104

Overview

Azure Role-Based Access Control (Azure RBAC) provides fine-grained authorization to manage Azure management plane resources. It operates on the core formula:

$$\text{Role Assignment} = \text{Security Principal} + \text{Role Definition} + \text{Scope}$$

Security Principal: User, group, service principal, or managed identity requesting access.
Role Definition: Collection of allowable permissions (Actions, NotActions, DataActions, NotDataActions).
Scope: Hierarchy boundary where access applies: Management Group > Subscription > Resource Group > Individual Resource. Permissions inherit downward.

---

When to Use: Built-In vs Custom Roles

Role Type	Best Used For	Key Characteristic
Owner	Primary Subscription Lead	Full access to all resources + ability to assign permissions to others.
Contributor	DevOps Engineers, Cloud Admins	Full access to create/manage resources; cannot grant access to others.
Reader	Auditors, Junior Ops	View-only access across resources; cannot modify or start/stop VMs.
User Access Administrator	Identity Governance Teams	Manage user access to Azure resources without granting resource control.
Custom Role	Principle of Least Privilege	Custom JSON restricting actions (e.g., allow restarting VMs, but block deleting disks).

---

Prerequisites

Administrator Permissions:

Owner or User Access Administrator at the target subscription or management group scope.
Azure CLI or Az PowerShell module installed.

---

Portal Path

TEXT

Azure Portal (https://portal.azure.com)
└── [Target Subscription / Resource Group]
    └── Access control (IAM)
        ├── Check access (Inspect effective permissions)
        ├── Role assignments (View and assign roles)
        └── Roles (Inspect built-in roles & create Custom Role)

---

Step-by-Step Implementation

Step 1: Assign a Built-in Role at Resource Group Scope

In the Azure portal, navigate to your target Resource Group (e.g., rg-production-networking).
Select Access control (IAM) > Click Add > Add role assignment.
Select role: Network Contributor > Click Next.
Select Members: Choose User, group, or service principal > Add group Sec-Azure-NetworkEngineers.
Review and assign.

Step 2: Author a Custom Role via JSON

Create a file named VirtualMachineOperator.json:

JSON / Graph Body

{
  "Name": "Virtual Machine Operator Custom",
  "IsCustom": true,
  "Description": "Can monitor and restart virtual machines, but cannot delete or reconfigure them.",
  "Actions": [
    "Microsoft.Compute/*/read",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/restart/action",
    "Microsoft.Network/*/read",
    "Microsoft.Insights/alertRules/*",
    "Microsoft.Support/*"
  ],
  "NotActions": [
    "Microsoft.Compute/virtualMachines/delete"
  ],
  "DataActions": [],
  "NotDataActions": [],
  "AssignableScopes": [
    "/subscriptions/11111111-2222-3333-4444-555555555555"
  ]
}

Step 3: Deploy the Custom Role via Azure CLI

Bash / Shell

# Create custom role definition in target subscription
az role definition create --role-definition VirtualMachineOperator.json

---

PowerShell Automation

Audit Role Assignments for a Specific User:

PowerShell

# Connect to Azure account
Connect-AzAccount

# Query all RBAC assignments for a user across all scopes
Get-AzRoleAssignment -SignInName "engineer@contoso.com" | 
    Select-Object RoleDefinitionName, Scope, ObjectType

Create Role Assignment via Azure PowerShell:

PowerShell

# Assign Contributor role to a group at Resource Group scope
New-AzRoleAssignment -ObjectId "group-object-id-here" `
    -RoleDefinitionName "Contributor" `
    -ResourceGroupName "rg-core-services"

---

Verification Checklist

VERIFICATION CHECKLIST

0/4 (0%)

Assigned user can view and restart virtual machines in the resource group.

Attempting to delete a disk or VM returns AuthorizationFailed (HTTP 403).

AssignableScopes in custom role is bounded to valid subscription IDs.

Check Access tab under IAM shows the correct inherited role assignments.

Troubleshooting Matrix

Error Code / Symptom	Root Cause	Exact Resolution
`AuthorizationFailed` (403)	User lacks required action in role definition or role assigned at wrong scope.	Use Check Access in IAM to verify effective permissions and inheritance path.
Cannot save Custom Role	Missing `AssignableScopes` or subscription ID formatted incorrectly.	Ensure `AssignableScopes` contains valid `/subscriptions/` format.

---

AZ-104 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

Inheritance: Permissions assigned at Management Group inherit down to Subscriptions, Resource Groups, and Resources. You cannot deny inherited permissions with normal RBAC; inheritance is additive.
NotActions Trap: NotActions is not a Deny rule. It simply subtracts operations from the Actions list. If another role grants the action, the user can perform it.
Contributor vs Owner: Contributor can do everything Owner can do except assign roles to other users.

---

Official Documentation

NEXT TOPIC1.2 Azure Governance: Management Groups, Azure Policy & Resource Locks