rBAC grants are additive, so a lower-privilege assignment does not restrict a broader Owner grant. In this case, a role assignment failed because the target group is in another unrelated tenant. “The combined permissions, including Owner” would not satisfy that requirement; the supported action is “The principal exists and is recognized in the target tenant”. RBAC assignment targets a tenant-resolvable security principal, not an arbitrary external group ID.

managed identities are service principals usable in RBAC assignments without embedding user credentials. In this case, a role assignment failed because the target group is in another unrelated tenant. “Assign the blob data-reader role to the managed identity principal” would not satisfy that requirement; the supported action is “The principal exists and is recognized in the target tenant”. RBAC assignment targets a tenant-resolvable security principal, not an arbitrary external group ID.

minimizing allowed actions and scope reduces risk from accidental or compromised access. In this case, a role assignment failed because the target group is in another unrelated tenant. “Use the smallest appropriate built-in or custom role at the smallest scope” would not satisfy that requirement; the supported action is “The principal exists and is recognized in the target tenant”. RBAC assignment targets a tenant-resolvable security principal, not an arbitrary external group ID.

this role grants targeted access-management abilities without general Owner resource administration. In this case, an engineer must find the scope and role by which a user accesses a resource. “Role Based Access Control Administrator instead of Owner” would not satisfy that requirement; the supported action is “Access control (IAM) role assignments and the user's effective access”. Reviewing scope and inheritance explains the source of effective permissions.

rBAC grants are additive, so a lower-privilege assignment does not restrict a broader Owner grant. In this case, an engineer must find the scope and role by which a user accesses a resource. “The combined permissions, including Owner” would not satisfy that requirement; the supported action is “Access control (IAM) role assignments and the user's effective access”. Reviewing scope and inheritance explains the source of effective permissions.

minimizing allowed actions and scope reduces risk from accidental or compromised access. In this case, an engineer must find the scope and role by which a user accesses a resource. “Use the smallest appropriate built-in or custom role at the smallest scope” would not satisfy that requirement; the supported action is “Access control (IAM) role assignments and the user's effective access”. Reviewing scope and inheritance explains the source of effective permissions.

this role grants targeted access-management abilities without general Owner resource administration. In this case, a user has a direct Owner grant and a group Reader grant on one resource group. “Role Based Access Control Administrator instead of Owner” would not satisfy that requirement; the supported action is “The combined permissions, including Owner”. RBAC grants are additive, so a lower-privilege assignment does not restrict a broader Owner grant.

reviewing scope and inheritance explains the source of effective permissions. In this case, a user has a direct Owner grant and a group Reader grant on one resource group. “Access control (IAM) role assignments and the user's effective access” would not satisfy that requirement; the supported action is “The combined permissions, including Owner”. RBAC grants are additive, so a lower-privilege assignment does not restrict a broader Owner grant.

rBAC assignment targets a tenant-resolvable security principal, not an arbitrary external group ID. In this case, a user has a direct Owner grant and a group Reader grant on one resource group. “The principal exists and is recognized in the target tenant” would not satisfy that requirement; the supported action is “The combined permissions, including Owner”. RBAC grants are additive, so a lower-privilege assignment does not restrict a broader Owner grant.

effective RBAC depends on the allowed actions at every applicable ancestor and resource scope. In this case, a privileged role assignment should be valid only for a narrow operational task. “Each role's actions and assignment scope against the requested resource” would not satisfy that requirement; the supported action is “Use the smallest appropriate built-in or custom role at the smallest scope”. Minimizing allowed actions and scope reduces risk from accidental or compromised access.

separating deployment operations from access delegation reduces privilege concentration. In this case, a privileged role assignment should be valid only for a narrow operational task. “Use Contributor for resource changes and reserve role assignment to access administrators” would not satisfy that requirement; the supported action is “Use the smallest appropriate built-in or custom role at the smallest scope”. Minimizing allowed actions and scope reduces risk from accidental or compromised access.

reviewing scope and inheritance explains the source of effective permissions. In this case, a privileged role assignment should be valid only for a narrow operational task. “Access control (IAM) role assignments and the user's effective access” would not satisfy that requirement; the supported action is “Use the smallest appropriate built-in or custom role at the smallest scope”. Minimizing allowed actions and scope reduces risk from accidental or compromised access.

separating deployment operations from access delegation reduces privilege concentration. In this case, a principal receives multiple overlapping role assignments and authorization appears inconsistent across resources. “Use Contributor for resource changes and reserve role assignment to access administrators” would not satisfy that requirement; the supported action is “Each role's actions and assignment scope against the requested resource”. Effective RBAC depends on the allowed actions at every applicable ancestor and resource scope.

minimizing allowed actions and scope reduces risk from accidental or compromised access. In this case, a principal receives multiple overlapping role assignments and authorization appears inconsistent across resources. “Use the smallest appropriate built-in or custom role at the smallest scope” would not satisfy that requirement; the supported action is “Each role's actions and assignment scope against the requested resource”. Effective RBAC depends on the allowed actions at every applicable ancestor and resource scope.

managed identities are service principals usable in RBAC assignments without embedding user credentials. In this case, a principal receives multiple overlapping role assignments and authorization appears inconsistent across resources. “Assign the blob data-reader role to the managed identity principal” would not satisfy that requirement; the supported action is “Each role's actions and assignment scope against the requested resource”. Effective RBAC depends on the allowed actions at every applicable ancestor and resource scope.

policy can identify or alter noncompliant tag properties under its assigned scope. In this case, an organization must deny creation of resources outside approved Azure regions. “Azure Policy with the appropriate tag policy effect” would not satisfy that requirement; the supported action is “Assign an Azure Policy definition restricting allowed locations”. Azure Policy evaluates resource properties during management operations to enforce approved location requirements.

a deny effect can prevent noncompliant resources from being created through management-plane operations. In this case, an organization must deny creation of resources outside approved Azure regions. “A deny-effect Azure Policy assignment that matches public IP creation” would not satisfy that requirement; the supported action is “Assign an Azure Policy definition restricting allowed locations”. Azure Policy evaluates resource properties during management operations to enforce approved location requirements.

deployIfNotExists or modify effects may require remediation for resources that already exist. In this case, an organization must deny creation of resources outside approved Azure regions. “Run the supported Azure Policy remediation task” would not satisfy that requirement; the supported action is “Assign an Azure Policy definition restricting allowed locations”. Azure Policy evaluates resource properties during management operations to enforce approved location requirements.

a deny effect can prevent noncompliant resources from being created through management-plane operations. In this case, a regulator requires certain tags on newly deployed resources. “A deny-effect Azure Policy assignment that matches public IP creation” would not satisfy that requirement; the supported action is “Azure Policy with the appropriate tag policy effect”. Policy can identify or alter noncompliant tag properties under its assigned scope.

azure Policy evaluates resource properties during management operations to enforce approved location requirements. In this case, a regulator requires certain tags on newly deployed resources. “Assign an Azure Policy definition restricting allowed locations” would not satisfy that requirement; the supported action is “Azure Policy with the appropriate tag policy effect”. Policy can identify or alter noncompliant tag properties under its assigned scope.

an initiative groups multiple policies into one assignable compliance and governance unit. In this case, a regulator requires certain tags on newly deployed resources. “An Azure Policy initiative containing the definitions” would not satisfy that requirement; the supported action is “Azure Policy with the appropriate tag policy effect”. Policy can identify or alter noncompliant tag properties under its assigned scope.

deployIfNotExists or modify effects may require remediation for resources that already exist. In this case, an administrator wants a consolidated compliance view for several related policy definitions. “Run the supported Azure Policy remediation task” would not satisfy that requirement; the supported action is “An Azure Policy initiative containing the definitions”. An initiative groups multiple policies into one assignable compliance and governance unit.

an exemption preserves the governing assignment while recording a reviewed exception for selected scope. In this case, an administrator wants a consolidated compliance view for several related policy definitions. “A narrowly scoped Azure Policy exemption with justification and expiry” would not satisfy that requirement; the supported action is “An Azure Policy initiative containing the definitions”. An initiative groups multiple policies into one assignable compliance and governance unit.

policy can identify or alter noncompliant tag properties under its assigned scope. In this case, an administrator wants a consolidated compliance view for several related policy definitions. “Azure Policy with the appropriate tag policy effect” would not satisfy that requirement; the supported action is “An Azure Policy initiative containing the definitions”. An initiative groups multiple policies into one assignable compliance and governance unit.

policy can identify or alter noncompliant tag properties under its assigned scope. In this case, a resource was deployed before a tag-remediation policy was introduced. “Azure Policy with the appropriate tag policy effect” would not satisfy that requirement; the supported action is “Run the supported Azure Policy remediation task”. DeployIfNotExists or modify effects may require remediation for resources that already exist.

an exemption preserves the governing assignment while recording a reviewed exception for selected scope. In this case, a resource was deployed before a tag-remediation policy was introduced. “A narrowly scoped Azure Policy exemption with justification and expiry” would not satisfy that requirement; the supported action is “Run the supported Azure Policy remediation task”. DeployIfNotExists or modify effects may require remediation for resources that already exist.

a deny effect can prevent noncompliant resources from being created through management-plane operations. In this case, a resource was deployed before a tag-remediation policy was introduced. “A deny-effect Azure Policy assignment that matches public IP creation” would not satisfy that requirement; the supported action is “Run the supported Azure Policy remediation task”. DeployIfNotExists or modify effects may require remediation for resources that already exist.

policy can identify or alter noncompliant tag properties under its assigned scope. In this case, a production subscription should not permit deployment of public IP resources. “Azure Policy with the appropriate tag policy effect” would not satisfy that requirement; the supported action is “A deny-effect Azure Policy assignment that matches public IP creation”. A deny effect can prevent noncompliant resources from being created through management-plane operations.

deployIfNotExists or modify effects may require remediation for resources that already exist. In this case, a production subscription should not permit deployment of public IP resources. “Run the supported Azure Policy remediation task” would not satisfy that requirement; the supported action is “A deny-effect Azure Policy assignment that matches public IP creation”. A deny effect can prevent noncompliant resources from being created through management-plane operations.

an initiative groups multiple policies into one assignable compliance and governance unit. In this case, a production subscription should not permit deployment of public IP resources. “An Azure Policy initiative containing the definitions” would not satisfy that requirement; the supported action is “A deny-effect Azure Policy assignment that matches public IP creation”. A deny effect can prevent noncompliant resources from being created through management-plane operations.

policy can identify or alter noncompliant tag properties under its assigned scope. In this case, a compliance dashboard reports a noncompliant resource that remains operational. “Azure Policy with the appropriate tag policy effect” would not satisfy that requirement; the supported action is “An audit-effect policy reports noncompliance but does not block deployment”. Audit evaluates and records deviations rather than denying the management request.

an initiative groups multiple policies into one assignable compliance and governance unit. In this case, a compliance dashboard reports a noncompliant resource that remains operational. “An Azure Policy initiative containing the definitions” would not satisfy that requirement; the supported action is “An audit-effect policy reports noncompliance but does not block deployment”. Audit evaluates and records deviations rather than denying the management request.

a deny effect can prevent noncompliant resources from being created through management-plane operations. In this case, a compliance dashboard reports a noncompliant resource that remains operational. “A deny-effect Azure Policy assignment that matches public IP creation” would not satisfy that requirement; the supported action is “An audit-effect policy reports noncompliance but does not block deployment”. Audit evaluates and records deviations rather than denying the management request.