Hands-On Cloud Administration in Azure

Role-based access control

We already mentioned RBAC and how it can help with the management and administration of cloud resources. RBAC allows you to use AAD accounts to set up different roles and permissions on different levels of the Azure tenant. In order to provide user administration rights in the tenant, we must use the AAD blade. These rights are not transferred further. Under the tenant, we can have multiple subscriptions, and subscription engagement is done separately for each subscription.

Assigning a user to admin (or some other role) will automatically provide them with the same role on all resource groups and resources under that subscription. If we assign a role to a user on the resource group level, the role will be automatically ...