owner combines resource management permissions with authority to delegate RBAC access at the selected scope. In this case, a security analyst only needs to restart a particular VM and must not receive broad subscription privileges. “Owner scoped to that subscription” would not satisfy that requirement; the supported action is “A narrowly scoped role granting the required VM action”. Least privilege pairs the needed operation with the smallest resource and action scope.

resource-group scope restricts effective management permissions to resources under that group. In this case, a security analyst only needs to restart a particular VM and must not receive broad subscription privileges. “Assign an appropriate role at the test resource-group scope” would not satisfy that requirement; the supported action is “A narrowly scoped role granting the required VM action”. Least privilege pairs the needed operation with the smallest resource and action scope.

this role focuses on RBAC assignment management at the designated scope. In this case, a security analyst only needs to restart a particular VM and must not receive broad subscription privileges. “Role Based Access Control Administrator at the resource group” would not satisfy that requirement; the supported action is “A narrowly scoped role granting the required VM action”. Least privilege pairs the needed operation with the smallest resource and action scope.

Management-plane Reader cannot fetch private blob content. In this case, a data analyst can read storage-account settings but gets a 403 retrieving blob contents. “Reader role on the storage account” would not satisfy that requirement; the supported action is “A blob data-plane role such as Storage Blob Data Reader”. Management-plane Reader permissions do not automatically authorize reading blob data.

Queue data authorization does not grant Blob service data permissions. In this case, a data analyst can read storage-account settings but gets a 403 retrieving blob contents. “Storage Queue Data Reader on the storage account” would not satisfy that requirement; the supported action is “A blob data-plane role such as Storage Blob Data Reader”. Management-plane Reader permissions do not automatically authorize reading blob data.

A compliance audit assignment does not grant blob-content read authorization. In this case, a data analyst can read storage-account settings but gets a 403 retrieving blob contents. “An Azure Policy audit assignment on the resource group” would not satisfy that requirement; the supported action is “A blob data-plane role such as Storage Blob Data Reader”. Management-plane Reader permissions do not automatically authorize reading blob data.

management-plane Reader permissions do not automatically authorize reading blob data. In this case, a user must upload blobs to one container without changing storage-account administration. “A blob data-plane role such as Storage Blob Data Reader” would not satisfy that requirement; the supported action is “Storage Blob Data Contributor at the required container”. A data-plane contributor role supports blob writes without broadly granting account management permissions.

the storage data authorization model is distinct from merely being able to inspect resource properties. In this case, a user must upload blobs to one container without changing storage-account administration. “Blob data-plane access is evaluated separately from management-plane Reader” would not satisfy that requirement; the supported action is “Storage Blob Data Contributor at the required container”. A data-plane contributor role supports blob writes without broadly granting account management permissions.

uploading images requires image push rights, not only read access to registry management settings. In this case, a user must upload blobs to one container without changing storage-account administration. “A registry/repository data-plane push role for the required registry mode” would not satisfy that requirement; the supported action is “Storage Blob Data Contributor at the required container”. A data-plane contributor role supports blob writes without broadly granting account management permissions.

Resource configuration Reader does not grant private blob-content read. In this case, an operator needs to browse a container but cannot read actual objects with Contributor management access. “Reader at the storage account resource scope” would not satisfy that requirement; the supported action is “The needed Storage Blob Data Reader role assignment”. Contributor manages the Azure resource but blob content access is controlled through data-plane permissions.

Azure Files SMB share access is distinct from Blob Storage data-plane roles. In this case, an operator needs to browse a container but cannot read actual objects with Contributor management access. “Storage File Data SMB Share Reader on the account” would not satisfy that requirement; the supported action is “The needed Storage Blob Data Reader role assignment”. Contributor manages the Azure resource but blob content access is controlled through data-plane permissions.

Billing read rights do not authorize reading blob objects. In this case, an operator needs to browse a container but cannot read actual objects with Contributor management access. “Cost Management Reader on the subscription” would not satisfy that requirement; the supported action is “The needed Storage Blob Data Reader role assignment”. Contributor manages the Azure resource but blob content access is controlled through data-plane permissions.

scope controls blast radius even when the assigned role is read-only. In this case, a reviewer needs to inspect role assignment metadata but not create new assignments. “A Reader assignment on only the relevant storage account” would not satisfy that requirement; the supported action is “Reader at the applicable scope”. Reader supports viewing resource and access assignment information without authorization to grant roles.

contributor manages the Azure resource but blob content access is controlled through data-plane permissions. In this case, a reviewer needs to inspect role assignment metadata but not create new assignments. “The needed Storage Blob Data Reader role assignment” would not satisfy that requirement; the supported action is “Reader at the applicable scope”. Reader supports viewing resource and access assignment information without authorization to grant roles.

resource action permissions can be granted without handing out Owner access. In this case, a reviewer needs to inspect role assignment metadata but not create new assignments. “A VM-scoped contributor or purpose-built VM operator role” would not satisfy that requirement; the supported action is “Reader at the applicable scope”. Reader supports viewing resource and access assignment information without authorization to grant roles.

a data-plane contributor role supports blob writes without broadly granting account management permissions. In this case, a developer must upload container images to an Azure Container Registry with RBAC repository permissions configured. “Storage Blob Data Contributor at the required container” would not satisfy that requirement; the supported action is “A registry/repository data-plane push role for the required registry mode”. Uploading images requires image push rights, not only read access to registry management settings.

management-plane Reader permissions do not automatically authorize reading blob data. In this case, a developer must upload container images to an Azure Container Registry with RBAC repository permissions configured. “A blob data-plane role such as Storage Blob Data Reader” would not satisfy that requirement; the supported action is “A registry/repository data-plane push role for the required registry mode”. Uploading images requires image push rights, not only read access to registry management settings.

contributor manages the Azure resource but blob content access is controlled through data-plane permissions. In this case, a developer must upload container images to an Azure Container Registry with RBAC repository permissions configured. “The needed Storage Blob Data Reader role assignment” would not satisfy that requirement; the supported action is “A registry/repository data-plane push role for the required registry mode”. Uploading images requires image push rights, not only read access to registry management settings.

a data-plane contributor role supports blob writes without broadly granting account management permissions. In this case, an engineer must start and stop a VM without creating role assignments. “Storage Blob Data Contributor at the required container” would not satisfy that requirement; the supported action is “A VM-scoped contributor or purpose-built VM operator role”. Resource action permissions can be granted without handing out Owner access.

reader supports viewing resource and access assignment information without authorization to grant roles. In this case, an engineer must start and stop a VM without creating role assignments. “Reader at the applicable scope” would not satisfy that requirement; the supported action is “A VM-scoped contributor or purpose-built VM operator role”. Resource action permissions can be granted without handing out Owner access.

contributor manages the Azure resource but blob content access is controlled through data-plane permissions. In this case, an engineer must start and stop a VM without creating role assignments. “The needed Storage Blob Data Reader role assignment” would not satisfy that requirement; the supported action is “A VM-scoped contributor or purpose-built VM operator role”. Resource action permissions can be granted without handing out Owner access.

contributor manages the Azure resource but blob content access is controlled through data-plane permissions. In this case, a finance auditor needs read-only access to a storage account's configuration and billing metadata. “The needed Storage Blob Data Reader role assignment” would not satisfy that requirement; the supported action is “A Reader assignment on only the relevant storage account”. Scope controls blast radius even when the assigned role is read-only.

management-plane Reader permissions do not automatically authorize reading blob data. In this case, a finance auditor needs read-only access to a storage account's configuration and billing metadata. “A blob data-plane role such as Storage Blob Data Reader” would not satisfy that requirement; the supported action is “A Reader assignment on only the relevant storage account”. Scope controls blast radius even when the assigned role is read-only.

the storage data authorization model is distinct from merely being able to inspect resource properties. In this case, a finance auditor needs read-only access to a storage account's configuration and billing metadata. “Blob data-plane access is evaluated separately from management-plane Reader” would not satisfy that requirement; the supported action is “A Reader assignment on only the relevant storage account”. Scope controls blast radius even when the assigned role is read-only.

management-plane Reader permissions do not automatically authorize reading blob data. In this case, a subscription Owner expects a user with Reader on a storage account to gain upload rights. “A blob data-plane role such as Storage Blob Data Reader” would not satisfy that requirement; the supported action is “Blob data-plane access is evaluated separately from management-plane Reader”. The storage data authorization model is distinct from merely being able to inspect resource properties.

a data-plane contributor role supports blob writes without broadly granting account management permissions. In this case, a subscription Owner expects a user with Reader on a storage account to gain upload rights. “Storage Blob Data Contributor at the required container” would not satisfy that requirement; the supported action is “Blob data-plane access is evaluated separately from management-plane Reader”. The storage data authorization model is distinct from merely being able to inspect resource properties.

scope controls blast radius even when the assigned role is read-only. In this case, a subscription Owner expects a user with Reader on a storage account to gain upload rights. “A Reader assignment on only the relevant storage account” would not satisfy that requirement; the supported action is “Blob data-plane access is evaluated separately from management-plane Reader”. The storage data authorization model is distinct from merely being able to inspect resource properties.

removing a lower-scope assignment cannot revoke a separate role granted higher in the hierarchy. In this case, a team has Reader on a subscription and Contributor on one resource group. “An independent ancestor-scope assignment still applies” would not satisfy that requirement; the supported action is “The union of applicable inherited and directly assigned RBAC roles”. Azure role assignments are additive across scopes and lower-scope grants supplement inherited rights.

child resources inherit permissions granted at parent scopes unless specific authorization mechanisms intervene. In this case, a team has Reader on a subscription and Contributor on one resource group. “RBAC scope inheritance from the resource group” would not satisfy that requirement; the supported action is “The union of applicable inherited and directly assigned RBAC roles”. Azure role assignments are additive across scopes and lower-scope grants supplement inherited rights.

a child-scope contributor assignment does not extend full write access to other subscription resources. In this case, a team has Reader on a subscription and Contributor on one resource group. “Contributor rights apply to that VM while Reader applies elsewhere” would not satisfy that requirement; the supported action is “The union of applicable inherited and directly assigned RBAC roles”. Azure role assignments are additive across scopes and lower-scope grants supplement inherited rights.

a child-scope contributor assignment does not extend full write access to other subscription resources. In this case, a user loses one group membership but keeps inherited subscription Reader access. “Contributor rights apply to that VM while Reader applies elsewhere” would not satisfy that requirement; the supported action is “An independent ancestor-scope assignment still applies”. Removing a lower-scope assignment cannot revoke a separate role granted higher in the hierarchy.

reader alone cannot delete resources, so a separate additive assignment likely permits the action. In this case, a user loses one group membership but keeps inherited subscription Reader access. “All effective roles from user, group and ancestor assignments” would not satisfy that requirement; the supported action is “An independent ancestor-scope assignment still applies”. Removing a lower-scope assignment cannot revoke a separate role granted higher in the hierarchy.

azure role assignments are additive across scopes and lower-scope grants supplement inherited rights. In this case, a user loses one group membership but keeps inherited subscription Reader access. “The union of applicable inherited and directly assigned RBAC roles” would not satisfy that requirement; the supported action is “An independent ancestor-scope assignment still applies”. Removing a lower-scope assignment cannot revoke a separate role granted higher in the hierarchy.