Azure RBAC vs Microsoft Entra roles
Azure RBAC roles control what you can do with Azure resources (virtual machines, storage, networks). Microsoft Entra roles control what you can do in the directory (users, groups, domains, licences, Conditional Access). The two systems are separate: by default, a Global Administrator has no access to Azure resources, and an Owner of a subscription cannot reset a user’s password. The decision rule for exams: ask what the object being managed is. A resource in a subscription means Azure RBAC; an identity or tenant setting means an Entra role.
Decision table
| Question | Azure RBAC | Microsoft Entra roles |
|---|---|---|
| What does it manage? | Azure resources, through Azure Resource Manager | Entra resources: users, groups, domains, app registrations, and services such as Microsoft 365 for some roles |
| Example roles | Owner, Contributor, Reader, Virtual Machine Contributor | Global Administrator, User Administrator, Billing Administrator |
| Scope levels | Management group, subscription, resource group, resource | Tenant (organisation-wide), administrative unit, or a single object such as one application |
| Assignment is made on | Access control (IAM) blade of the scope | Roles and administrators in the Entra admin center |
| Custom roles | Yes | Yes |
| Can grant access to others | Owner, User Access Administrator, and Role Based Access Control Administrator can assign roles | Global Administrator and Privileged Role Administrator can assign roles |
Both can be made just-in-time with Privileged Identity Management, which lists “Microsoft Entra roles” and “Azure resources” as separate areas.
How Azure RBAC decides
An Azure role assignment has three parts: a security principal (user, group, service principal or managed identity), a role definition (a set of allowed actions), and a scope. Scopes form a hierarchy, and an assignment at a higher level is inherited by everything below it. Permissions are additive: a user who is Contributor on a subscription and Reader on one resource group in it effectively has Contributor, and the Reader assignment changes nothing. Only a deny assignment blocks an action that a role allows. A role’s NotActions are not a deny: they only remove actions from that role’s own wildcard, so if a second role grants the same action, the user can still perform it.
Three roles apply to every resource type, and the differences between them are tested constantly:
- Owner: full management of resources and the right to assign roles.
- Contributor: full management of resources, but cannot assign roles.
- Reader: view only.
User Access Administrator manages access but does not create resources.
The one bridge: elevate access
The systems stay apart until a Global Administrator turns on Access management for Azure resources in the portal. That grants them the User Access Administrator Azure role at root scope over all subscriptions and management groups in the tenant. Microsoft describes it as a way to regain access, for example when the only person with access to a subscription has left. The usual procedure afterwards is to remove the elevation again.
Worked example
Priya joins as helpdesk lead. Her job: reset passwords for ordinary users in the tenant, and restart (but not create or delete) virtual machines in resource group rg-web-prod.
Two different systems are needed, so two assignments:
- Entra role: Helpdesk Administrator (or Password Administrator) at tenant scope, or scoped to an administrative unit if she should only manage some users.
- Azure role: a custom Azure role with
Microsoft.Compute/virtualMachines/readandMicrosoft.Compute/virtualMachines/restart/action, assigned at the scope ofrg-web-prod. No general built-in role is limited to restarting VMs: Virtual Machine Contributor also allows creating and deleting them, and Contributor on the subscription would be far too broad.
Neither assignment gives anything to the other. If someone proposes making Priya Global Administrator “so she can do both”, that is the wrong answer on two counts: it grants no Azure resource access by default, and it breaks least privilege.
Which exams test this
| Exam | How it appears | Covered on this site |
|---|---|---|
| AZ-104 | Manage Azure identities and governance (20–25%): manage built-in Azure roles, assign roles at different scopes and interpret access assignments. Entra roles are not an objective, so the Azure RBAC side is what is tested | Identities and governance |
| AZ-900 | Describe Azure architecture and services (35–40%): describe Azure role-based access control, at concept level | Architecture and services |
| SC-900 | Capabilities of Microsoft Entra (25–30%): describe Microsoft Entra roles and role-based access control | Microsoft Entra explained |
| SC-300 | Implement and manage user identities (20–25%): configure built-in and custom Entra roles, decide when to use administrative units and evaluate effective role permissions. The governance domain adds Entra roles and Azure resources in PIM | User identities |
| AZ-305 | Design identity, governance, and monitoring solutions (25–30%): recommend a solution for authorizing access to Azure resources, which in practice means choosing roles and scopes | Identity, governance and monitoring |
| SC-500 | Manage identity, access, and governance (20–25%): manage built-in Azure role assignments, manage custom Azure and Entra roles, and find and fix overprivileged assignments with Azure RBAC | Identity, access and governance |
The SC-900 row follows the English outline that applies from October 21, 2026, and the SC-300 row the one from October 28, 2026; both change logs list only minor changes.
How questions are built around it
The standard setup is a user who needs to do one thing and a list of roles from both systems. The test is whether you spot which system the task lives in:
- Verbs on identities (reset a password, create a user, manage licences, register an application) point to an Entra role.
- Verbs on resources (create a VM, read a storage account, delete a resource group) point to an Azure role.
- “Least privilege” means the narrowest scope and the smallest role: a resource group instead of a subscription, a specific role instead of Owner.
- “Without being able to grant access to others” rules out Owner, User Access Administrator and Role Based Access Control Administrator, and points to Contributor.
- “Restore access to a subscription nobody can reach” is the Global Administrator elevation described above.
- “Only some users” for an Entra role suggests an administrative unit, not a resource group.
Watch for the classic subscription administrator roles in older material: Co-Administrator and Service Administrator. Microsoft states they are fully retired as of May 2026, with Azure RBAC the way to manage access, so treat them as legacy.
Azure RBAC is also not Azure Policy. RBAC answers who can act; Policy answers what configuration is allowed.
Practice questions
Question 1. A support engineer must be able to reset passwords for ordinary (non-administrator) users in the Microsoft Entra tenant. The engineer must not be able to create or delete Azure virtual machines. Which assignment meets the requirement with the least privilege?
- A. The Helpdesk Administrator Microsoft Entra role
- B. The Contributor Azure role on the subscription
- C. The Owner Azure role on the subscription
- D. The Reader Azure role on the subscription
Show answer
Answer: A
Resetting passwords is a directory task, so it needs a Microsoft Entra role such as Helpdesk Administrator or Password Administrator, which grants nothing on Azure resources. Contributor and Owner are Azure roles for managing resources: they do not manage users and would allow VM changes. Reader at subscription scope only allows viewing resources.
Question 2. The only person with access to a production subscription has left the company. You are a Global Administrator, but the subscription does not appear in your Azure portal and you cannot assign roles on it. What should you do?
- A. Assign yourself the Privileged Role Administrator Entra role
- B. Create a new Microsoft Entra tenant and move the subscription into it
- C. Enable Access management for Azure resources, then assign a role on the subscription
- D. Create a Conditional Access policy that grants you access to the subscription
Show answer
Answer: C
A Global Administrator has no Azure resource access by default, but can enable Access management for Azure resources, which grants the User Access Administrator Azure role at root scope across the tenant. From there, you can assign a role on the subscription. Assigning yourself another Entra role does not touch Azure resources, moving the subscription to a new tenant requires access to the subscription in the first place, and a Conditional Access policy governs sign-in, not Azure role assignments.
Go deeper
- Azure roles, Microsoft Entra roles, and classic subscription administrator roles (Microsoft Learn)
- What is Azure RBAC? (Microsoft Learn)
- Elevate access to manage all Azure subscriptions and management groups (Microsoft Learn)
- Related on this site: PIM, Conditional Access and the AZ-104 identity guide.