Understanding the difference between Microsoft Entra ID roles and Azure RBAC roles for access control

Question

I am currently learning about Microsoft Entra ID and Azure security concepts, and I am trying to understand how identity-based access control differs from resource-based access control.

From my understanding, Microsoft Entra ID roles are mainly used to manage identity-related tasks, while Azure RBAC roles control access to Azure resources.

However, I would like clarification on how organizations decide when to use Entra ID roles versus Azure RBAC roles, especially in scenarios where administrators need access to both identities and Azure resources.

Are there any recommended practices for assigning these roles while following the principle of least privilege?

Answer 1

Microsoft Entra ID roles and Azure RBAC roles serve different control planes and should be assigned based on what must be administered.

• Microsoft Entra roles control access to Microsoft Entra resources such as users, groups, applications, and other Microsoft services that rely on Entra administration.
• Azure RBAC roles control access to Azure resources such as subscriptions, resource groups, virtual machines, and storage through Azure Resource Manager.

A practical way to decide is:

1. Use Microsoft Entra roles when the task is directory or tenant administration.
   • Examples: managing users, groups, applications, or tenant-wide identity settings.
2. Use Azure RBAC roles when the task is managing Azure resources.
   • Examples: deploying resources, managing VMs, assigning access on subscriptions or resource groups.
3. Use both only when the job truly spans both areas.
   • Some administrators need identity administration and Azure resource administration, but these permissions are not automatically combined.

Important distinctions:

• Microsoft Entra roles and Azure RBAC are separate role-based access control systems.
• Microsoft Entra role permissions cannot be used in Azure custom roles, and Azure role permissions cannot be used in Microsoft Entra custom roles.
• By default, a Global Administrator does not have access to Azure resources.
• If a Global Administrator enables Access management for Azure resources in the Azure portal, that user is granted the User Access Administrator Azure role on all subscriptions in the tenant. This is intended for regaining or managing access, not as a default operating model.

For organizations deciding how to assign access:

1. Separate identity administration from resource administration where possible.
   • Use Entra roles for tenant-wide identity services.
   • Use Azure RBAC for Azure subscriptions, resource groups, and resources.
2. Assign at the narrowest scope possible.
   • Azure RBAC supports scope at management group, subscription, resource group, and resource.
   • Microsoft Entra roles can be scoped at tenant level, administrative unit, or individual object for some scenarios.
3. Prefer built-in or narrowly defined custom roles over broad roles.
   • Both systems support custom roles.
4. Follow least privilege.
   • Grant only the permissions required for the task.
   • Avoid using highly privileged roles such as Global Administrator except for emergency scenarios.
5. Use just-in-time elevation where available.
   • Both Microsoft Entra roles and Azure RBAC roles integrate with Microsoft Entra Privileged Identity Management for controls such as approval workflow and MFA.

Recommended practice for mixed admin scenarios:

• An identity administrator who manages users and groups should receive an appropriate Microsoft Entra role, not broad Azure RBAC access unless Azure resource work is also required.
• An Azure platform or application administrator who deploys and manages infrastructure should receive the appropriate Azure RBAC role at the correct scope, not a tenant-wide Entra admin role unless identity tasks are also required.
• If one person must do both, assign the minimum required role in each system separately rather than relying on a broad tenant-wide role.

In short, the decision is based on what is being managed:

• Identity, directory, and Microsoft 365-related administration → Microsoft Entra roles
• Azure subscriptions and resources → Azure RBAC roles

---

References:

• Understand roles in Microsoft Entra ID
• Overview of role-based access control in Microsoft Entra ID
• Azure roles, Microsoft Entra roles, and classic subscription administrator roles
• Azure resource management fundamentals
• Landing zone identity and access management