role-assignment

Role assignment (RBAC)

What it is

A role assignment is the act of binding all three RBAC elements together:

Security principal (who) + role definition (what they can do) + scope (where) = an assignment.

It’s the only thing that actually grants access — a role definition alone grants nothing.

Why it exists

Access is a relationship, not a property. Assignments make “who can do what, where” explicit, auditable, and scoped, which is how least-privilege gets implemented and governed.

Key ideas

• Security principal — user, group, service principal/managed identity, or managed identity.
• Scope hierarchy — management group → subscription → resource group → resource; assignments inherit down.
• Best practice — assign roles to groups (not individuals) at the highest scope that still gives least privilege.
• Owners can assign; Contributors cannot (see role-definition).
• Assigning roles requires the Microsoft.Authorization/roleAssignments permission (blocked by default Contributor).

How it fits (diagram)

Exam notes

• Know the scope hierarchy + inheritance — the most-tested RBAC concept.
• Assign to groups, use least privilege, remember inheritance.
• You must be Owner/User Access Administrator yourself to grant roles.

Related

rbac · role-definition · scope · groups · service-principal

📘 Source: Microsoft Learn — Role Assignment