role-definition

Role definition (RBAC)

What it is

A role definition is the “what may this identity do?” template in Azure RBAC. It is a named collection of permissions, such as the action to start a VM. It becomes effective only when a role assignment gives it to a principal at a scope.

Why it exists

Roles let you express permissions as a reusable, named unit (Reader, Contributor, Owner) instead of raw action lists, so assignments are readable and auditable.

Key ideas

• Built-in roles: common examples are Owner (manage resources and role assignments), Contributor (manage resources but not role assignments), Reader (view resources), and User Access Administrator (manage user access). The exact permissions live in the role definition, not in the friendly name alone.
• Management versus data plane: an Azure-resource management role does not automatically grant data access. A role such as Storage Blob Data Reader grants data-plane access to blobs; a management role can manage the storage account without necessarily reading its blobs.
• Custom roles: use only when a built-in role cannot meet a real least-privilege need. They list allowed Actions and DataActions, with NotActions and NotDataActions exclusions. They are defined for one or more assignable scopes.
• Wildcard caution: * is broad. Treat it as a design decision that needs review, not as a convenient default.

Northwind example

Northwind gives its deployment group the built-in Contributor role at one application resource group. That lets the group manage the application resources but not create role assignments. The application’s managed identity separately receives Storage Blob Data Reader only on the required storage scope. These are different role definitions because managing the storage account is not the same as reading its customer files.

How it fits (diagram)

Exam notes

• Contributor vs Owner: a key difference is that Owner can manage role assignments while Contributor cannot.
• Built-in roles are the default answer; custom roles are the exception.
• Data-plane roles (storage/SQL) are distinct from control-plane roles.

Related

rbac · role-assignment · scope · service-principal

📘 Source: Microsoft Learn — Understand Azure role definitions