AZ-104 Objective 1.2: Manage Access to Azure Resources

Key RBAC Concepts:

• Security Principal: An identity that can be assigned access (user, group, service principal, managed identity)
• Role Definition: A collection of permissions that define what actions can be performed
• Role Assignment: The process of attaching a role definition to a security principal at a specific scope
• Scope: The set of resources that the access applies to (management group, subscription, resource group, or resource)
• Permission: An action that can be performed on a resource (read, write, delete, etc.)

RBAC Characteristics:

• Identity-based: Permissions are assigned to identities, not resources
• Inheritance: Permissions are inherited from parent scopes
• Additive: Multiple role assignments are combined (no deny rules)
• Azure-native: Built into Azure Resource Manager

Other Access Control Methods:

• Access Control Lists (ACLs): Resource-specific permissions
• Shared Access Signatures (SAS): Time-limited access tokens
• Conditional Access: Context-based access policies
• Azure Policy: Resource configuration and compliance

Owner:

• Full access: Can manage everything including access to resources
• Permissions: All actions on all resources
• Use case: Subscription or resource group administrators
• Scope: Can be assigned at any scope

Contributor:

• Full access: Can manage everything except access to resources
• Permissions: All actions except role assignments
• Use case: Developers and resource managers
• Scope: Can be assigned at any scope

Reader:

• Read-only access: Can view all resources but cannot modify them
• Permissions: Read actions only
• Use case: Auditors, monitoring personnel
• Scope: Can be assigned at any scope

User Access Administrator:

• Access management: Can manage user access to Azure resources
• Permissions: Role assignments and access management
• Use case: Identity administrators
• Scope: Can be assigned at any scope

Virtual Machine Roles:

• Virtual Machine Contributor: Manage VMs but not access to them
• Virtual Machine Administrator Login: Login to VMs as administrator
• Virtual Machine User Login: Login to VMs as regular user

Storage Roles:

• Storage Account Contributor: Manage storage accounts
• Storage Blob Data Contributor: Read, write, and delete blob data
• Storage Queue Data Contributor: Read, write, and delete queue data
• Storage Table Data Contributor: Read, write, and delete table data

Network Roles:

• Network Contributor: Manage networks but not access to them
• DNS Zone Contributor: Manage DNS zones and records
• Traffic Manager Contributor: Manage Traffic Manager profiles

Database Roles:

• SQL DB Contributor: Manage SQL databases but not access to them
• SQL Server Contributor: Manage SQL servers but not access to them
• Cosmos DB Account Reader Role: Read Cosmos DB account data

Step-by-Step Process:

1. Navigate to IAM: Go to any resource → Access control (IAM)
2. View Roles: Click "Roles" tab to see all available roles
3. Filter Roles: Use filters to find specific roles
4. View Role Details: Click on a role to see its permissions
5. Examine Permissions: Review Actions, NotActions, DataActions, and NotDataActions

PowerShell Commands:

# Connect to Azure
Connect-AzAccount

# Get all built-in roles
Get-AzRoleDefinition | Where-Object {$_.IsCustom -eq $false}

# Get specific role definition
Get-AzRoleDefinition -Name "Contributor"

# Get roles by name pattern
Get-AzRoleDefinition | Where-Object {$_.Name -like "*Storage*"}

# Get role permissions in detail
$role = Get-AzRoleDefinition -Name "Storage Account Contributor"
$role.Actions
$role.NotActions
$role.DataActions
$role.NotDataActions

Azure CLI Commands:

# Login to Azure
az login

# List all built-in roles
az role definition list --query "[?isCustom==false]"

# Get specific role definition
az role definition show --name "Contributor"

# List roles by name pattern
az role definition list --query "[?contains(name, 'Storage')]"

# Get role permissions
az role definition show --name "Storage Account Contributor" --query "permissions"

Permission Components:

• Actions: Control plane operations (create, read, update, delete resources)
• NotActions: Excluded control plane operations
• DataActions: Data plane operations (read, write data within resources)
• NotDataActions: Excluded data plane operations
• AssignableScopes: Scopes where the role can be assigned

Permission Examples:

• Microsoft.Storage/storageAccounts/read: Read storage account properties
• Microsoft.Storage/storageAccounts/blobServices/containers/read: Read blob containers
• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read: Read blob data
• Microsoft.Compute/virtualMachines/start/action: Start virtual machines

Scope Levels (from broadest to narrowest):

1. Management Group: Organize subscriptions and apply governance
2. Subscription: Billing boundary and access control boundary
3. Resource Group: Logical container for related resources
4. Resource: Individual Azure resources (VM, storage account, etc.)

Scope Inheritance:

• Inheritance: Permissions assigned at higher scopes are inherited by lower scopes
• Additive: Multiple role assignments are combined (no deny rules)
• Effective Permissions: Sum of all role assignments at current and parent scopes

Step-by-Step Process:

1. Navigate to Scope: Go to the desired scope (management group, subscription, resource group, or resource)
2. Access IAM: Click "Access control (IAM)" in the left navigation
3. Add Role Assignment: Click "Add" → "Add role assignment"
4. Select Role: Choose the appropriate role from the list
5. Assign Access To: Select User, Group, Service Principal, or Managed Identity
6. Select Members: Choose specific users, groups, or identities
7. Review and Assign: Review the assignment and click "Save"

Role Assignment Commands:

# Assign role at subscription scope
New-AzRoleAssignment -SignInName "user@contoso.com" -RoleDefinitionName "Reader" -Scope "/subscriptions/{subscription-id}"

# Assign role at resource group scope
New-AzRoleAssignment -SignInName "user@contoso.com" -RoleDefinitionName "Contributor" -ResourceGroupName "MyResourceGroup"

# Assign role at resource scope
New-AzRoleAssignment -SignInName "user@contoso.com" -RoleDefinitionName "Storage Blob Data Contributor" -Scope "/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Storage/storageAccounts/{storage-account}"

# Assign role to a group
New-AzRoleAssignment -ObjectId "group-object-id" -RoleDefinitionName "Virtual Machine Contributor" -ResourceGroupName "MyResourceGroup"

# Assign role to service principal
New-AzRoleAssignment -ObjectId "service-principal-object-id" -RoleDefinitionName "Contributor" -Scope "/subscriptions/{subscription-id}"

# Assign role to managed identity
New-AzRoleAssignment -ObjectId "managed-identity-object-id" -RoleDefinitionName "Reader" -ResourceGroupName "MyResourceGroup"

Azure CLI Commands:

# Assign role at subscription scope
az role assignment create --assignee "user@contoso.com" --role "Reader" --scope "/subscriptions/{subscription-id}"

# Assign role at resource group scope
az role assignment create --assignee "user@contoso.com" --role "Contributor" --resource-group "MyResourceGroup"

# Assign role at resource scope
az role assignment create --assignee "user@contoso.com" --role "Storage Blob Data Contributor" --scope "/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Storage/storageAccounts/{storage-account}"

# Assign role to a group
az role assignment create --assignee "group-object-id" --role "Virtual Machine Contributor" --resource-group "MyResourceGroup"

# Assign role to service principal
az role assignment create --assignee "service-principal-object-id" --role "Contributor" --scope "/subscriptions/{subscription-id}"

# Assign role to managed identity
az role assignment create --assignee "managed-identity-object-id" --role "Reader" --resource-group "MyResourceGroup"

Best Practices:

• Governance Roles: Assign Owner, Contributor, or Reader roles for governance
• Policy Management: Assign Policy Contributor for policy management
• Cost Management: Assign Cost Management Contributor for cost oversight
• Security: Assign Security Admin for security policy management

Common Assignments:

• Enterprise Administrators: Owner role for top-level governance
• IT Administrators: Contributor role for resource management
• Auditors: Reader role for compliance monitoring

Best Practices:

• Subscription Owners: Limit to 2-3 trusted administrators
• Service Principals: Use for automated deployments and management
• Resource Groups: Prefer resource group assignments over subscription assignments
• Monitoring: Assign monitoring roles for observability

Common Assignments:

• Subscription Administrators: Owner or Contributor roles
• DevOps Teams: Contributor role for CI/CD pipelines
• Monitoring Teams: Monitoring Contributor role

Best Practices:

• Team-based Access: Assign roles based on team responsibilities
• Environment Separation: Different roles for dev, test, prod environments
• Service-specific Roles: Use service-specific roles when available
• Least Privilege: Grant minimum required permissions

Common Assignments:

• Development Teams: Contributor role for development resources
• Operations Teams: Service-specific contributor roles
• Support Teams: Reader role for troubleshooting

Best Practices:

• Data Access: Use data-specific roles for data access
• Service Management: Use service-specific roles for service management
• Backup and Recovery: Assign backup-specific roles
• Monitoring: Assign monitoring roles for specific resources

Common Assignments:

• Storage Data Access: Storage Blob Data Contributor, Storage Queue Data Contributor
• Database Access: SQL DB Contributor, Cosmos DB Account Reader
• Virtual Machine Access: Virtual Machine Administrator Login, Virtual Machine User Login

Permission Calculation Process:

1. Collect All Assignments: Gather all role assignments for the user at current and parent scopes
2. Combine Permissions: Merge all Actions and DataActions from assigned roles
3. Apply Exclusions: Remove any NotActions and NotDataActions
4. Determine Effective Permissions: Final set of permissions the user actually has

Example Calculation:

• Subscription Level: Reader role (read permissions)
• Resource Group Level: Contributor role (all permissions except access management)
• Resource Level: Storage Blob Data Contributor (blob data access)
• Effective Permissions: All permissions from all three roles combined

Step-by-Step Process:

1. Navigate to Resource: Go to the specific resource or scope
2. Access IAM: Click "Access control (IAM)"
3. View Assignments: Click "Role assignments" tab
4. Filter Assignments: Use filters to find specific users or roles
5. View Details: Click on assignments to see details
6. Check Access: Use "Check access" to verify specific user permissions

Access Assignment Commands:

# Get all role assignments at subscription scope
Get-AzRoleAssignment -Scope "/subscriptions/{subscription-id}"

# Get role assignments for specific user
Get-AzRoleAssignment -SignInName "user@contoso.com"

# Get role assignments at resource group scope
Get-AzRoleAssignment -ResourceGroupName "MyResourceGroup"

# Get role assignments for specific role
Get-AzRoleAssignment -RoleDefinitionName "Contributor"

# Get role assignments for specific resource
Get-AzRoleAssignment -Scope "/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Storage/storageAccounts/{storage-account}"

# Get effective permissions for a user
$user = Get-AzADUser -UserPrincipalName "user@contoso.com"
Get-AzRoleAssignment -ObjectId $user.Id

# Check if user has specific permission
$assignments = Get-AzRoleAssignment -SignInName "user@contoso.com"
foreach ($assignment in $assignments) {
    $role = Get-AzRoleDefinition -Id $assignment.RoleDefinitionId
    Write-Host "Role: $($role.Name)"
    Write-Host "Actions: $($role.Actions -join ', ')"
    Write-Host "Scope: $($assignment.Scope)"
    Write-Host "---"
}

Azure CLI Commands:

# List all role assignments at subscription scope
az role assignment list --scope "/subscriptions/{subscription-id}"

# List role assignments for specific user
az role assignment list --assignee "user@contoso.com"

# List role assignments at resource group scope
az role assignment list --resource-group "MyResourceGroup"

# List role assignments for specific role
az role assignment list --role "Contributor"

# List role assignments for specific resource
az role assignment list --scope "/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Storage/storageAccounts/{storage-account}"

# Check access for a specific user
az role assignment list --assignee "user@contoso.com" --all

# Get detailed information about assignments
az role assignment list --assignee "user@contoso.com" --include-inherited --query "[].{Role:roleDefinitionName, Scope:scope, Principal:principalName}"

Systematic Troubleshooting Process:

1. Verify User Identity: Confirm the user exists and is active
2. Check Role Assignments: Review all role assignments for the user
3. Verify Scope: Ensure role is assigned at correct scope
4. Check Inheritance: Verify permissions are inherited from parent scopes
5. Review Conditional Access: Check for conditional access policies
6. Test with Different User: Compare with working user assignments
7. Check Audit Logs: Review access logs for denied attempts

Comprehensive Access Analysis:

# Function to analyze user access
function Get-UserAccessAnalysis {
    param(
        [string]$UserPrincipalName,
        [string]$ResourceScope
    )
    
    Write-Host "=== Access Analysis for $UserPrincipalName ===" -ForegroundColor Green
    
    # Get user object
    $user = Get-AzADUser -UserPrincipalName $UserPrincipalName
    if (-not $user) {
        Write-Host "User not found: $UserPrincipalName" -ForegroundColor Red
        return
    }
    
    # Get all role assignments
    $assignments = Get-AzRoleAssignment -ObjectId $user.Id -IncludeClassicAdministrators
    
    Write-Host "=== Role Assignments ===" -ForegroundColor Yellow
    foreach ($assignment in $assignments) {
        $role = Get-AzRoleDefinition -Id $assignment.RoleDefinitionId
        Write-Host "Role: $($role.Name)" -ForegroundColor Cyan
        Write-Host "Scope: $($assignment.Scope)" -ForegroundColor White
        Write-Host "Assignment Type: $($assignment.ObjectType)" -ForegroundColor White
        Write-Host "Actions: $($role.Actions -join ', ')" -ForegroundColor Gray
        Write-Host "---"
    }
    
    # Check effective permissions at specific scope
    if ($ResourceScope) {
        Write-Host "=== Effective Permissions at $ResourceScope ===" -ForegroundColor Yellow
        $effectiveAssignments = $assignments | Where-Object { $_.Scope -like "$ResourceScope*" -or $ResourceScope -like "$($_.Scope)*" }
        
        $allActions = @()
        $allDataActions = @()
        
        foreach ($assignment in $effectiveAssignments) {
            $role = Get-AzRoleDefinition -Id $assignment.RoleDefinitionId
            $allActions += $role.Actions
            $allDataActions += $role.DataActions
        }
        
        Write-Host "Effective Actions: $($allActions | Sort-Object -Unique | Join-String -Separator ', ')" -ForegroundColor Green
        Write-Host "Effective Data Actions: $($allDataActions | Sort-Object -Unique | Join-String -Separator ', ')" -ForegroundColor Green
    }
}

# Usage example
Get-UserAccessAnalysis -UserPrincipalName "user@contoso.com" -ResourceScope "/subscriptions/{subscription-id}/resourceGroups/{rg-name}"

Operational Recommendations:

• Documentation: Document role assignments and their purposes
• Naming Conventions: Use consistent naming for custom roles
• Testing: Test role assignments in non-production environments
• Automation: Use Infrastructure as Code for role assignments
• Monitoring: Set up alerts for unusual access patterns
• Backup Access: Ensure backup administrators have necessary access

Essential Reports:

• Role Assignment Reports: Track all role assignments and changes
• Access Review Reports: Monitor access review completion and outcomes
• Privileged Access Reports: Track privileged role activations
• Service Principal Reports: Monitor service principal activities
• Guest User Reports: Track external user access
• Audit Logs: Monitor all access-related activities

Access Monitoring Commands:

# Get all role assignments with details
Get-AzRoleAssignment | Select-Object DisplayName, RoleDefinitionName, Scope, ObjectType | Export-Csv -Path "role-assignments.csv"

# Get users with Owner role
Get-AzRoleAssignment -RoleDefinitionName "Owner" | Where-Object {$_.ObjectType -eq "User"}

# Get service principals with Contributor role
Get-AzRoleAssignment -RoleDefinitionName "Contributor" | Where-Object {$_.ObjectType -eq "ServicePrincipal"}

# Get role assignments by scope
Get-AzRoleAssignment | Group-Object Scope | Select-Object Name, Count

# Get unused role assignments (users not signed in for 90 days)
$cutoffDate = (Get-Date).AddDays(-90)
$inactiveUsers = Get-AzADUser | Where-Object {$_.LastSignInDateTime -lt $cutoffDate}
foreach ($user in $inactiveUsers) {
    Get-AzRoleAssignment -ObjectId $user.Id
}

# Generate access summary report
$report = @()
$assignments = Get-AzRoleAssignment
foreach ($assignment in $assignments) {
    $role = Get-AzRoleDefinition -Id $assignment.RoleDefinitionId
    $report += [PSCustomObject]@{
        Principal = $assignment.DisplayName
        Role = $role.Name
        Scope = $assignment.Scope
        Type = $assignment.ObjectType
        AssignmentType = $assignment.AssignmentType
    }
}
$report | Export-Csv -Path "access-summary.csv"

Sample Exam Questions:

1. What is the difference between the Owner and Contributor built-in roles?
2. Which scope has the broadest level of access in Azure RBAC?
3. How do you assign a role to a service principal using PowerShell?
4. What is the difference between Actions and DataActions in role definitions?
5. How are effective permissions calculated in Azure RBAC?
6. Which role would you assign to allow someone to manage virtual machines but not access them?
7. What is the purpose of the User Access Administrator role?
8. How do you check what permissions a user has at a specific scope?
9. What is the difference between a service principal and a managed identity?
10. Which PowerShell cmdlet is used to create a new role assignment?