Azure Access Level Privileges of Role Assignments

Question

Azure Access Level Privileges of Role Assignments

Piyush Shukla 25

Hello,

I have an Azure storage account (Call it Blob1). At the blob level of the storage account, I have assigned a contributor role to a group Group1, which has a user User1. Inside this blob, I have created a container Container1, which I have assigned a Reader role to Group2, which also has user User1. I want to understand what is the final privileges for User1. Will it be Contributor level on Container1 for User1?

Regards,

Piyush

0 comments

Answer accepted by question author

Marcin Policht 107.2K MVP Volunteer Moderator

RBAC follows the cumulative model - so within the lower scope User1 will have the role (Contributor) inherited from the higher scope (in addition to the one assigned explicitly at the lower scope (Reader). Just keep in mind that there is a distinction between the control plane and data plane roles

More at https://learn.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access?tabs=portal

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Piyush Shukla 25 Reputation points

2024-12-29T14:24:33.4033333+00:00

Understood Marcin, that was helpful. Thank you.

1 additional answer

Your answer

Piyush Shukla 25 Reputation points

2024-12-29T14:24:33.4033333+00:00

Understood Marcin, that was helpful. Thank you.

Answer 1

Hi Piyush Shukla ,

Greetings & Welcome to Microsoft Q&A forum! Thanks for posting your query!

Adding more information to the above response!

In Azure RBAC, the effective permissions for a user are the union of all the role assignments they have. This means that User1 will have the combined permissions of both the Contributor role at the blob level and the Reader role at the container level.

For User1:

Contributor Role at Blob Level: This role allows User1 to manage everything within the blob, including creating, deleting, and modifying containers and blobs.

Reader Role at Container Level: This role allows User1 to read and list the blobs within the container.

Since the Contributor role includes permissions to read, write, and delete, and these permissions are broader than those of the Reader role, User1 will effectively have Contributor-level permissions on container1. This means User1 can read, write, and delete blobs within container1

For more information:
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
User's image

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.