Azure RBAC: Roles, Scopes and Role Assignments

You work in two CLI sessions: your own (the admin) and Asha’s. The trick is the AZURE_CONFIG_DIR variable, which makes the CLI keep a second, separate sign-in in another folder. Run every block in your normal admin window unless it says Asha’s window.

1Create two resource groups

Run this:

$sub = az account show --query id -o tsv
$tenant = az account show --query tenantId -o tsv
foreach ($g in 'rg-saat-l07','rg-saat-l07b') { az group create --name $g --tags course=saatvedha-azure lesson=07 -o none }
$rg = az group show --name rg-saat-l07 --query id -o tsv
$rg

You should see something like this:

/subscriptions/6f1c2d3e-4a5b-4c6d-8e9f-0a1b2c3d4e5f/resourceGroups/rg-saat-l07

2Look inside the Contributor role

Run this:

az role definition list --name Contributor --query "[0].permissions[0].{actions:actions, notActions:notActions}" -o json

You should see something like this (the notActions list is longer):

{
  "actions": [
    "*"
  ],
  "notActions": [
    "Microsoft.Authorization/*/Delete",
    "Microsoft.Authorization/*/Write",
    "Microsoft.Authorization/elevateAccess/Action",
    ...
  ]
}

Everything, minus anything under Microsoft.Authorization that writes or deletes. Those are the role assignment operations.

3Give the helpdesk group Contributor on one resource group

Run this:

$grp = az ad group show --group grp-saat-helpdesk --query id -o tsv
az role assignment create --assignee-object-id $grp --assignee-principal-type Group --role Contributor --scope $rg -o none
az role assignment list --scope $rg --query "[].{who:principalName, role:roleDefinitionName}" -o table

You should see something like this:

Who                Role
-----------------  -----------
grp-saat-helpdesk  Contributor

--assignee-principal-type Group tells Azure what kind of object it is, which avoids a lookup that can fail just after a group is created.

4Sign in as Asha in her own CLI session

Open a second PowerShell window (Asha’s window) and run this:

$env:AZURE_CONFIG_DIR = 'C:\azure-lab\asha-cli'
az login --tenant <your-tenant-id>
az group list --query "[].name" -o tsv

Replace <your-tenant-id> with the value of $tenant from your admin window. In the sign-in window choose Use another account, sign in as Asha and approve MFA.

You should see this:

rg-saat-l07

Asha sees only the group she was given. rg-saat-l07b doesn’t even appear in her list.

5Asha builds something where she is allowed, and tries where she isn’t

In Asha’s window, run this:

az network nsg create --resource-group rg-saat-l07 --name nsg-saat-l07 --tags course=saatvedha-azure lesson=07 --query "NewNSG.provisioningState" -o tsv
az network nsg create --resource-group rg-saat-l07b --name nsg-saat-l07b --tags course=saatvedha-azure lesson=07

You should see something like this:

Succeeded
(AuthorizationFailed) The client 'asha.rao@priyakoutlook.onmicrosoft.com' with object id '3c2b1a09-...'
does not have authorization to perform action 'Microsoft.Network/networkSecurityGroups/write' over scope
'/subscriptions/6f1c2d3e-.../resourceGroups/rg-saat-l07b/providers/Microsoft.Network/networkSecurityGroups/nsg-saat-l07b'
or the scope is invalid. If access was recently granted, please refresh your credentials.
Code: AuthorizationFailed

A network security group costs nothing, so it’s a safe thing to test with. The first one succeeds; the second fails, and the message names the action and scope. That’s least privilege working as planned.

6See all of Asha’s access in one view

Back in your admin window, run this:

$domain = az rest --method get --url "https://graph.microsoft.com/v1.0/domains" --query "value[?isDefault].id" -o tsv
az role assignment list --assignee "asha.rao@$domain" --all --include-groups --query "[].{role:roleDefinitionName, scope:scope}" -o table

You should see something like this:

Role         Scope
-----------  --------------------------------------------------------------------------
Contributor  /subscriptions/6f1c2d3e-4a5b-4c6d-8e9f-0a1b2c3d4e5f/resourceGroups/rg-saat-l07

--include-groups shows roles that come from her group membership, which is how most access arrives at work. Without it you’d see nothing and think she has no access at all.

✅ Checkpoint: Asha can create things in rg-saat-l07 and gets AuthorizationFailed in rg-saat-l07b.