- [Instructor] Now that we've had an overview
of Azure RBAC roles, let's go ahead
and apply a role to a resource group.
I'm already in our RBACRG resource group.
I can go ahead and select access control,
and at this point I can go ahead and select add,
and as you can see, our list of builtin roles is quite long.
I'm gonna scroll all the way down
and select the virtual machine operator role.
Next I'm going to assign it to a user,
in this case jasper.
I can go ahead and click save.
Now jasper has some rights that are associated
with the virtual machine operator role
to this resource group, and only to this resource group.
If I had done this at the subscription
level he would've inherited the rights,
and we can see that with some of the other roles.
For example, we have Watson up at the top,
he's a backup contributor and he inherited those rights
to this resource group from the subscription level.
Now, let's take a look at how we do this user PowerShell.
The first thing we'll do is assign a role
at the subscription level, and to do so
we'll use a command like New-AzureRmRoleAssignment,
we'll provide the sign in name.
I have a user called RBAC user.
The role definition, in this case it'll be contributor,
and the scope will be for the subscription.
We can see RBAC user has now been assigned
a contributor role at the subscription level.
We can now use Get-AzureRmRoleAssignment
to see the details of that role for that specific user,
and basically it'll be the same as what we just saw.
Next we're going to assign the role to the resource group,
and that's what we just did in the portal,
and the command is the same to the role definition.
Now we're going to change it to reader, and the
resource group name will be the RBACRG resource group.
And we can now see that the scope includes
the resource group and that the role definition is reader.
Again, I could go ahead and list the access,
and finally, let's go ahead and remove access.
Then we'll start by removing the
role assignment from the subscription,
and to do so we'll use Remove-AzureRmRoleAssignment,
the username, the role definition,
which will be contributor, and the scope.
To verify that this worked,
let's run Get-AzureRmRoleAssignment
for that user and the scope,
and you'll notice nothing was returned
because that role is no longer assigned to that scope,
and let's repeat the same procedure to remove
the role assignment from the RBACRG group.
And once again, to verify we'll run
Get-AzureRmRoleAssignment, specifying
the user and the resource group,
and as before, nothing will be returned.
For the exam you should be very familiar
with these PowerShell cmdlets.