role-definition

Role definition (RBAC)

What it is

A role definition is the “what you can do” part of RBAC. It’s a named collection of permissions (actions) written as allowed/denied operations on Azure resource types — e.g. Microsoft.Compute/virtualMachines/start/action.

Why it exists

Roles let you express permissions as a reusable, named unit (Reader, Contributor, Owner) instead of raw action lists, so assignments are readable and auditable.

Key ideas

• Built-in roles — Azure ships many, most importantly for AZ-104:
  • Owner — full control incl. role assignments.
  • Contributor — full management, except role assignments (can’t grant access).
  • Reader — can view, cannot change.
  • User Access Administrator — manage role assignments.
  • Data-plane roles — e.g. Storage Blob Data Reader, SQL DB Contributor.
• Custom roles — you define when built-ins don’t fit, by listing specific actions/notActions scoped to a management group, subscription, or resource group.
• Action list — * = all; data actions vs management actions.

How it fits (diagram)

Exam notes

• Contributor vs Owner: the defining difference is the ability to assign roles.
• Built-in roles are the default answer; custom roles are the exception.
• Data-plane roles (storage/SQL) are distinct from control-plane roles.

Related

rbac · role-assignment · scope · service-principal

📘 Source: Microsoft Learn — Role Definition