AZ-305
Deep Dive
Authorization design in AZ-305 revolves around the principle of least privilege: choosing the most restrictive role possible, at the smallest possible scope, assigned to groups. And when no built-in role fits, designing a custom role.
Contents
🔑RBAC — role inheritance by scope
User John has Reader assigned on the Subscription and Contributor on RG-Frontend. Roles flow downward. Hover over each node to see the effective access.
Effective access — John
Subscription
RG-Frontend
RG-Backend
VM web-01
Key rule
Permissions are additive. The most permissive role wins. Only a Deny Assignment breaks this rule.
⬇️ Downward inheritance
A role on the Subscription applies to every RG and resource in that Subscription. A role on an RG applies only to the resources in that RG.
➕ RBAC is additive
Multiple assignments are unioned together. Reader on Sub + Contributor on RG = effective Contributor on that RG. The most permissive role wins.
🚫 No upward inheritance
Contributor on RG-Frontend grants no access on RG-Backend or on the Subscription. Permissions only flow downward.
An RBAC assignment = security principal (user, group, service principal, managed identity) + role definition (list of allowed actions) + scope (management group, subscription, RG or resource). Assignments are inherited downward and are additive.
Evaluation rules
Design best practices
| Role | Allows | Does NOT allow |
|---|---|---|
| Owner | Everything, including managing RBAC | — |
| Contributor | Create/manage all resources | Assign roles, reliably manage locks |
| Reader | View all resources | Any changes; doesn't read secrets/data |
| User Access Administrator | Manage access (assign roles) | Manage resources |
| Role Based Access Control Administrator | Assign roles with conditions (more restricted than UAA) | Manage resources |
| Storage Blob Data Contributor | Read/write/delete blobs (data plane) | Manage the storage account itself |
| Key Vault Administrator | Full data plane of Key Vault (RBAC mode) | Manage the Key Vault resource itself (control plane) |
| Network Contributor | Manage networking (VNets, NSGs...) | Other resource types |
| Virtual Machine Contributor | Manage VMs | Access the VNet or log in to the VM |
Classic trap
Contributor CANNOT assign roles. If a scenario asks for someone to manage resources AND grant access to others, they need Owner or Contributor + User Access Administrator (better: RBAC Administrator with conditions, less privilege).
Create a custom role only when no built-in role satisfies least privilege. Classic example: "operators must be able to restart VMs but not create or delete them" — no built-in role gives exactly that.
Anatomy of a custom role
{
"Name": "VM Operator",
"Description": "Restart and view VMs",
"Actions": [
"Microsoft.Compute/virtualMachines/read",
"Microsoft.Compute/virtualMachines/restart/action",
"Microsoft.Compute/virtualMachines/start/action"
],
"NotActions": [],
"DataActions": [],
"AssignableScopes": [
"/providers/Microsoft.Management/
managementGroups/production"
]
}Design rules
Entra ID roles (directory)
Azure RBAC (resources)
| Requirement | Design |
|---|---|
| Devs manage resources in their RG but can't grant access to others | Contributor on the resource group |
| App reads blobs without account keys | Managed identity + Storage Blob Data Reader (DataAction) |
| Operators only restart/start VMs | Custom role (read + start/restart actions) |
| Reuse a custom role across 20 subscriptions | AssignableScopes = parent management group |
| Helpdesk resets user passwords | Entra ID role: Helpdesk/User Administrator (not RBAC) |
| Manage who has access without being able to touch resources | User Access Administrator (or RBAC Administrator with conditions) |
| Admin access only during incidents | PIM with eligible assignment |
| 1000 users with the same access | Assign to a security group, never individually |
Did you get this topic?
Test what you just learned
The operations team must be able to start, stop and restart production VMs across 15 subscriptions, without being able to create, delete or reconfigure them. You want minimal administrative effort. What do you design?
Put what you learned to the test with original AZ-305 exam questions.
Start AZ-305 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.