25 Azure RBAC Roles Interview Questions and Answers

Introduction to Azure Role-Based Access Control (RBAC)

Azure Role-Based Access Control (RBAC) is a robust system for managing access to Azure resources. RBAC allows you to grant appropriate permissions to users, groups, or applications at different scopes, ensuring that users have the right level of access to perform their tasks without compromising security.

1. What is Azure RBAC?

Azure RBAC is a security system that enables you to manage access to Azure resources based on roles assigned to users or groups. It helps to control access rights, ensuring users have the necessary permissions to perform specific actions on resources.

2. What are the three primary components of Azure RBAC?

The three primary components of Azure RBAC are:

• Role Definitions: Predefined sets of permissions that define the actions users can perform.
• Assignments: Assigning a role to a user, group, or service principal at a specific scope.
• Scope: The level at which you can assign RBAC roles, such as a subscription, resource group, or resource.

3. What are built-in roles in Azure RBAC?

Azure RBAC provides several built-in roles that cover common scenarios. Some of the commonly used built-in roles are:

• Contributor
• Reader
• Owner
• User Access Administrator
• Contributor
• Resource Manager Service
• and more...

4. How do you assign a role to a user in Azure RBAC?

To assign a role to a user in Azure RBAC, follow these steps:

1. Go to the Azure portal.
2. Open the resource group or resource you want to assign access to.
3. Select "Access control (IAM)" from the left-hand menu.
4. Click "Add role assignment."
5. Select the role and the user you want to assign.
6. Click "Save."

5. What is the difference between Owner and Contributor roles?

The main difference between Owner and Contributor roles is their level of access. The "Owner" role has full access to all resources within a scope, including the ability to manage RBAC roles. On the other hand, the "Contributor" role can perform actions on resources but does not have permission to manage access to those resources.

6. What is the User Access Administrator role?

The "User Access Administrator" role in Azure RBAC grants permissions to manage user access to resources. Users with this role can assign roles to other users, groups, or service principals for specific resources.

7. What are the different types of scopes in Azure RBAC?

The different types of scopes in Azure RBAC are:

• Management Group: The highest level of scope that covers multiple subscriptions.
• Subscription: A single subscription.
• Resource Group: A group of resources within a subscription.
• Resource: A single Azure resource.

8. Can you assign a role to a group in Azure RBAC?

Yes, you can assign a role to a group in Azure RBAC. It simplifies access management by assigning a role to a group, and all members of that group automatically inherit the assigned role's permissions.

9. How can you list the role assignments in Azure?

You can list the role assignments in Azure using Azure PowerShell or Azure CLI commands. For example:

az role assignment list --scope /subscriptions/{subscription-id}

10. What is the purpose of the "Resource Locks" feature in Azure RBAC?

Resource Locks prevent accidental deletion or modification of critical Azure resources. It allows you to set a lock on a resource, which prevents any user or process from deleting or modifying the resource until the lock is removed.

11. How do you create a custom role in Azure RBAC?

To create a custom role in Azure RBAC, you can use Azure PowerShell or Azure CLI. Here's an example of creating a custom role using Azure PowerShell:

New-AzRoleDefinition -Name "CustomRole" -Description "Custom Role Description" -Actions { "Microsoft.Storage/storageAccounts/*" } -AssignableScopes { "/subscriptions/{subscription-id}" }

12. What is the purpose of "Actions" in an RBAC role definition?

"Actions" in an RBAC role definition specify the operations or actions that a user assigned to that role can perform on the resources. For example, "Microsoft.Storage/storageAccounts/*" allows all actions on the storage account resource.

13. How do you delete a role assignment in Azure RBAC?

You can delete a role assignment in Azure RBAC using the Azure portal or PowerShell/CLI commands. For example:

Remove-AzRoleAssignment -Scope /subscriptions/{subscription-id} -SignInName user@example.com

14. What is the difference between RBAC and Azure AD Privileged Identity Management (PIM)?

RBAC focuses on granting static roles with predefined permissions to users, groups, or service principals. In contrast, Azure AD Privileged Identity Management (PIM) allows temporary elevation of privileges, providing just-in-time access to sensitive actions for a limited duration to reduce the attack surface.

15. How do you enable Azure AD Privileged Identity Management (PIM) for a user?

You can enable Azure AD Privileged Identity Management (PIM) for a user through the Azure AD portal. Follow these steps:

1. Sign in to the Azure portal as a Global Administrator or Privileged Role Administrator.
2. Go to "Azure Active Directory."
3. Under "Security," select "Privileged Identity Management."
4. Select "Azure AD roles."
5. Find and select the role you want to enable PIM for.
6. Click "Add assignments."
7. Select the user(s) you want to enable PIM for.
8. Click "Add."
9. Click "Activate."

16. What is the purpose of the "Deny" effect in RBAC role assignments?

The "Deny" effect is used to explicitly block certain permissions for a user, group, or service principal, even if they are granted by other roles. It takes precedence over any "Allow" effect and can be used to restrict specific actions on resources.

17. How can you assign a role to a managed identity for an Azure resource?

To assign a role to a managed identity for an Azure resource, follow these steps:

1. Open the resource for which you want to assign access in the Azure portal.
2. Select "Access control (IAM)" from the left-hand menu.
3. Click "Add role assignment."
4. Select the role and search for the managed identity in the "Select" box.
5. Click "Save."

18. What is the "Reader" role in Azure RBAC?

The "Reader" role in Azure RBAC allows users to view resources but not make any changes. It provides read-only access to resources and is useful when you want to grant someone the ability to view configurations, settings, and status of resources without giving them the ability to modify anything.

19. How do you assign multiple roles to a user for a single resource in Azure RBAC?

To assign multiple roles to a user for a single resource in Azure RBAC, you can follow these steps:

1. Open the resource for which you want to assign access in the Azure portal.
2. Select "Access control (IAM)" from the left-hand menu.
3. Click "Add role assignment."
4. Select the first role you want to assign.
5. Click "Save."
6. Repeat steps 3 to 5 for each additional role you want to assign.

20. What is the purpose of the "Resource Provider" in Azure RBAC?

The "Resource Provider" in Azure RBAC is responsible for managing the lifecycle of a specific type of resource. It controls access to the operations that can be performed on that resource type. For example, the "Microsoft.Storage" resource provider manages storage accounts, and its roles control actions related to storage accounts.

21. What are Service Principal Managed Identities (MSIs) in Azure RBAC?

Service Principal Managed Identities (MSIs) are a type of managed identity that represents a service principal within Azure AD. They allow applications, services, and automation tools to authenticate securely and access Azure resources without the need for explicit credentials like usernames and passwords.

22. How do you assign a role to a Service Principal in Azure RBAC?

To assign a role to a Service Principal in Azure RBAC, you can use Azure PowerShell or Azure CLI. Here's an example using Azure PowerShell:

New-AzRoleAssignment -ApplicationId "Your-Service-Principal-AppId" -RoleDefinitionName "Contributor" -Scope "/subscriptions/{subscription-id}"

23. What is the difference between "Owner" and "User Access Administrator" roles?

The "Owner" role has full access to all resources within a scope, including the ability to manage access control. On the other hand, the "User Access Administrator" role can only manage access to resources and cannot perform management actions on the resources themselves.

24. What happens if a user has multiple role assignments with conflicting permissions?

If a user has multiple role assignments with conflicting permissions (e.g., one role grants "Read" access while another grants "Deny" access to the same resource), the "Deny" effect takes precedence, and the user will be denied the conflicting actions, regardless of the other roles that grant "Allow" permissions.

25. How do you create a custom role with specific permissions in Azure RBAC?

You can create a custom role with specific permissions in Azure RBAC by defining the necessary actions in the role definition. For example, to create a role that allows read access to virtual machines and read/write access to storage accounts, you would include the appropriate actions in the role definition.