- [Narrator] Role-Based Access Control, or RBAC,
is used to control access to your Azure resources
and this lesson will probably be a review for most of you.
And we'll start off by comparing
Azure Active Directory Admin Roles versus RBAC Roles.
RBAC Roles provide access management to Azure resources.
Where Azure Active Directory roles are used to manage
Azure Active Directory resources,
which includes managing users,
assigning admin roles, resetting passwords,
managing licenses, and managing domains.
Let's take a look at the typical hierarchy for Azure.
And we'll start off with
the Azure Admin Roles AD Active Directory.
From there, we have the Root Level
and this is the Global Admin, or User Access Admin
and User Access Admin is elevated access.
It is at the Root Management Group and below
that we can then start applying the Azure RBAC Roles.
And these roles include Owner, Contributor,
there's Custom Roles and Built-in Roles
and these can be applied to
The Root Management Group, The Management Group,
Subscription, or at the resource level.
RBAC Role Assignments consist of three elements,
those being the Security principal,
the Role definition, and the Scope.
Let's explore each of these,
starting with the Security Principal.
The Security Principal is the who
or what is requesting access to the resource
and it can be a user, a group, or a service principal.
Next we have the Role Definition,
which is a collection of permissions.
And the roles include the owner, contributor, or reader
and those are the default roles.
The User access administrator,
again this is an elevated privilege.
There's the built-in roles,
as well as we can create custom roles.
And finally, we have the Scope,
which is the boundary of the access
and that scope could be for a subscription,
a resource group, or simply a resource
And keep in mind
that RBAC uses the Parent-child relationship,
meaning roles are inherited through the hierarchy.
If you have not had the opportunity
to play with roles yet in Azure,
I would highly recommended you do so
and you may want to brush up on your
Powershell commandlets that are associated with RBAC.