Understanding role-based access control
In Chapter 2, Governance and Security, we mentioned security principles such as segregation of duties and the principle of least privilege. With role-based access control (RBAC), we have the technical feature to implement these principles in Azure AD. RBAC is the way to manage access to all Azure resources, but also to Azure AD and Office 365.
As already discussed earlier, Azure offers several levels of scope that can be used to grant access rights to accounts. Furthermore, there are several built-in roles, such as Owner, Security Admin, or Reader. To create a role assignment, you need to bring together three different entities:
- A security principal, which can be either one of users, groups, or service principals.
- A role, which describes a set of management rights. For example, the contributor role contains all actions, except authorization-related rights. So, a contributor may manage all aspects within a given scope without being...
