A control plane action manages an Azure resource itself rather than the data stored inside it. Azure RBAC records these permissions in actions and notActions. section 2.3.2
Separate resource management from access to resource data:
- A Reader role on a resource group lets Bob view a storage account but does not, by default, let him read its stored data. section 2.3.2
- Assign control-plane permissions at resource, resource-group, subscription, or management-group scope to limit access. section 2.3.2
az role definition list --name "Virtual Machine Contributor"
Inspect a role definition to identify the control-plane actions it permits, such as virtual-machine management. section 2.3.2
