Role assignment

As explained in Azure Security

A role assignment is an Azure authorization object that binds a role definition to a security principal at a specified scope.

A role assignment grants a security principal the permissions in a role definition over a chosen Azure scope. It joins the “who,” “what,” and “on what” of Azure RBAC; removing the assignment removes that access. section 2.3.2 section 2.3.3

Choose scope carefully to limit breach impact. Assignments can apply at resource, resource group, subscription, or management group level; management groups are widest in reach and therefore carry the broadest effect. section 2.3.2

Figure 2.10 Core components of role assignments in Azure RBAC

Use the component diagram to verify that every assignment names a security principal, a role definition, and a scope. section 2.3.3

Create an assignment with an account that has Owner or User Access Administrator status:

• Identify the assignee object ID for a user, service principal, or group. section 2.3.4
• Select a role by name or ID, such as Virtual Machine Contributor. section 2.3.2 section 2.3.4
• Set the target scope and run az role assignment create; inspect the resulting principal ID, role definition ID, and scope. section 2.3.4

Subscription-scoped VM access

Assigning Virtual Machine Contributor to a user at subscription scope lets that principal receive the permissions of that role across the selected subscription. The returned object records the principal, role definition, subscription, and scope. section 2.3.3 section 2.3.4

For privileged Azure roles managed through Privileged Identity Management (PIM), assignments can be permanent (active) or time-bound eligible. Eligible identities assume the role only when needed and can be required to use MFA or obtain approval during activation. section 2.6.2

How Azure Security covers it

How deep it goes

Walks through scopes, required assignment permissions, Azure CLI creation, returned fields, and PIM active versus eligible assignments.

Examples

Uses Virtual Machine Contributor at subscription scope and an exercise assigning Storage Blob Data Contributor to a service principal at resource scope.

What it assumes

Assumes an available identity and role definition, then teaches how scope and assignment fields combine to grant access.

What you can do after

Apply it via Azure CLI to grant a user, group, or service principal a selected role at a selected scope.

How it connects

Connects Azure RBAC with security principals, role definitions, scopes, least privilege, and Privileged Identity Management.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Microsoft Azure in ActionA role assignment is a configuration that grants a specified authorization role to an identity for a scope such as a resource or resource group.
• 

  liveBookmanning.com
  Authorization in ActionA role assignment is a configuration that associates a principal with an authorization role.

Compare how 3 books explain role assignment →

Related concepts

• principalhas part · A principal is a security identity representing an entity, such as a person, application, service, machine, or process, in an authentication or authorization system.
• role configurationhas part · A role configuration specifies a role and its associated responsibilities, permissions, or expected behavior within a system or organization.
• scopehas part · Scope is a defined boundary specifying which entities, activities, resources, or conditions are included or governed in a particular context.
• role-based access controlused by · Role-based access control is an authorization model that assigns permissions to roles and grants users or other principals access through their assigned roles.
• Kubernetesconfigures · Kubernetes is an open-source platform for orchestrating and automating the deployment, scaling, and management of containerized workloads across computing clusters.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.