Share via

RBAC Inheritance

Cloud Learner 0 Reputation points
2023-05-29T03:38:51.59+00:00

If we have a reader role provided at Management groups RBAC and if we provide an owner role for a specific subscription under the same management group. I could notice reader permissions are working for the user.

Is that right? if yes, what is the solution or workaround here?

Thanks in advance.
Hemanth

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
968 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andreas Baumgarten 123.4K Reputation points MVP Volunteer Moderator
    2023-06-05T12:36:31.4266667+00:00

    Hi @Cloud Learner ,

    Azure roles assignments and permissions are an additive model. If you assign a user to different user roles (Reader and Owner ) on different scopes (Management Groups and Subscription) the user gets the sum of the role assignments/permissions based on the scopes.

    In your example, for instance User1:

    User1 is in the Reader role for the Management Group1 scope -> User1 gets reader permissions to all subscriptions related to this management group.

    In addition User1 is assigned to the Owner role for Subscription1 (and Subscription1 is related to the Management Group): -> User1 gets owner permission in addition to the reader permission for Subscription1.

    Source: RBAC - Multiple role assignments

    (If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

    Regards

    Andreas Baumgarten

    1 person found this answer helpful.
    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.