azure RBAC

eg1995 1,126 Reputation points
2022-06-03T13:54:22.373+00:00

hi team,

can anyone advise what is the priority when it comes to RBAC in the azure AD hierarchy?

suppose i have on the tenant management group a user who is assigned a reader role, however i assigned also the owner role for the same user on the resource group which is under a subscription that is under the management group itself

in this case, the user will get access as an owner to the resource or just a reader?

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
660 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,389 questions
Accepted answer
  1. Manu Philip 16,966 Reputation points MVP
    2022-06-03T15:12:08.61+00:00

    Here are the two principles of Azure RBAC precedence:

    Azure RBAC is an additive model, so your effective permissions are the sum of your role assignments. Consider the following example where a user is granted the Contributor role at the subscription scope and the Reader role on a resource group. The sum of the Contributor permissions and the Reader permissions is effectively the Contributor role for the subscription. Therefore, in this case, the Reader role assignment has no impact.

    Deny assignments block users from performing specified actions even if a role assignment grants them access. Deny assignments take precedence over role assignments.

    In your case, the user will get the Owner role as well as the reader role in the tenant

    --please don't forget to upvote and Accept as answer if the reply is helpful--

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest