Role configuration

As explained in Microsoft Azure in Action

A role definition is a named collection of permissions that specifies the actions allowed by an authorization role.

A role definition is the “what” of Azure role-based access control (RBAC): a named collection of permissions such as read, write, or delete. RBAC combines it with a security principal and a scope to create a role assignment. section 6.7.2 section 6.7

Choose role definitions with maintenance in mind:

• Prefer Azure’s built-in roles, including Owner, Contributor, Reader, DNS Zone Contributor, and other service-specific roles. section 6.7.2
• Create a custom role only when no built-in role fits; custom permissions require ongoing tracking, naming, and maintenance. section 6.7.2 section 6.7.3
• Separate the role definition from scope: the definition states what an identity may do, while scope states where it may do it. section 6.7.3

Assigning Contributor access

For the Alpaca-Ma-Bags identity, open the AlpacaRG resource group, choose Access Control (IAM), select Add Role Assignment, choose the built-in Contributor role, select the members, and review the assignment. Contributor permits management of applicable resources without passing that capability to other users. section 6.7.3

Figure 6.33 RBAC components

Use the RBAC components diagram to see how the security principal, role definition, and scope combine into authorization. section 6.7

How Microsoft Azure in Action covers it

How deep it goes

Explains permissions, built-in and custom options, and their combination with principals and scopes; stops short of custom-role syntax.

Examples

Uses Owner, Contributor, Reader, DNS Zone Contributor, and a Contributor assignment to the AlpacaRG resource group.

What it assumes

Assumes familiarity with Azure identities and resources while defining RBAC’s principal, role definition, and scope model.

What you can do after

Apply it via Azure RBAC by selecting a role, scope, and members in Access Control (IAM).

How it connects

Connects role definitions with RBAC, security principals, scopes, and role assignments.

liveBookmanning.com

Read Microsoft Azure in Action on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Azure SecurityA role definition is an authorization specification that groups permissions into a role assignable to identities.

Compare how 2 books explain role configuration →

Related concepts

• role assignmentpart of · A role assignment is an access-control configuration that grants a principal an authorization role or specified permissions for a defined scope.
• authorizationuses · Authorization is the determination and enforcement of rules governing which subjects may access resources or perform operations.
• role-based access controlpart of · Role-based access control is an authorization model that assigns permissions to roles and grants users or other principals access through their assigned roles.
• custom roleincludes · A custom role is a user-defined authorization role with an explicitly selected set of permissions or privileges.
• built-in roleincludes · An Azure built-in role is a predefined role containing a provider-defined set of permissions assignable to identities for managing Azure resources.
• collaborationconfigures · Collaboration is coordinated activity in which multiple participants contribute toward a shared goal or outcome.

This explainer was generated by Manning's knowledge graph from the text of Microsoft Azure in Action. The section links point to the parts of the book it draws on.