Start with the control plane
Azure role-based access control (Azure RBAC) authorizes actions against Azure resources. A role definition contains allowed operations, while the role assignment connects a security principal, role and scope. Common scopes are management group, subscription, resource group and individual resource.
Microsoft Entra roles authorize administrative work in the tenant directory. They cover identity tasks such as managing users, groups, enterprise applications and directory settings. A directory role alone does not grant permission to operate a virtual machine or storage account.
Example 1: let an application team manage VMs
The team must start, stop and update virtual machines in one application resource group. Assign an appropriate Azure RBAC role at that resource-group scope. Do not grant a tenant-wide Microsoft Entra role; it does not solve the resource-access requirement and would add unrelated privileges.
Example 2: let help desk reset passwords
The help desk needs to reset passwords for supported users but does not manage Azure infrastructure. Use the least-privileged Microsoft Entra role that covers the required password-reset tasks. Do not assign Contributor or Owner because those Azure RBAC roles govern resources, not directory password administration.
Example 3: give an auditor read-only resource access
Assign the Azure RBAC Reader role at the smallest useful scope. Subscription scope is appropriate when the auditor must view all resources in that subscription; resource-group scope is safer when the review is limited to one workload.
Troubleshooting scenario: User Administrator cannot restart a VM
Situation: An operator could update user accounts in Microsoft Entra ID but received an authorization error when attempting to restart an Azure virtual machine.
The role applied to the wrong control plane
User Administrator grants directory capabilities. It does not include the Azure resource action required to restart a VM.
AuthorizationFailed
Action: Microsoft.Compute/virtualMachines/restart/action
Reason: role assignment does not allow this resource actionAssign a narrow Azure RBAC role
The access owner selected a role containing the required VM operations and assigned it only to the relevant resource group. The directory role remained separate.
Principal: VM operations team
Role: appropriate VM operations role
Scope: /subscriptions/.../resourceGroups/app-prodFirst identify whether the request targets an Azure resource or the Microsoft Entra directory. Then choose the matching role system and apply least privilege at the narrowest practical scope.
Illustrative training scenario and console-style messages—not a customer incident or production screenshot.AZ-104 exam clues
- Subscription, resource group, VM or storage: think Azure RBAC.
- User, group, application registration or directory administration: think Microsoft Entra role.
- Inherited access: check whether an Azure RBAC assignment exists at a parent scope.
- Least privilege: avoid Owner or Global Administrator when a narrower role meets the task.
- Just-in-time administration: distinguish permanent access from eligible, time-bound elevation when the scenario includes privileged identity management.
Common mistakes to avoid
- Assuming Global Administrator automatically has permission to manage every Azure resource.
- Assigning Owner at subscription scope for a task limited to one resource group.
- Using an Azure RBAC role to solve a user or group administration requirement.
- Ignoring inherited role assignments when investigating unexpected access.
- Forgetting that a deny assignment or organizational policy can affect the result.
Quick answer rule
If the task changes an Azure resource, evaluate Azure RBAC and resource scope. If the task changes an identity or directory object, evaluate Microsoft Entra roles. A person may need both, but each assignment solves a different requirement.
Frequently asked questions
What is the simplest difference between Azure RBAC and Microsoft Entra roles?
Azure RBAC controls access to Azure resources such as subscriptions, resource groups, virtual machines and storage. Microsoft Entra roles control identity and directory tasks such as managing users, groups and applications.
Is Global Administrator the same as Owner in Azure?
No. Global Administrator is a Microsoft Entra directory role. Owner is an Azure RBAC role for Azure resources at an assigned scope. They protect different control planes and should not be treated as interchangeable.
Can one person have both role types?
Yes, when the job requires both directory administration and Azure resource administration. Assign each role separately and use the narrowest role and scope that meets the requirement.
How does Azure RBAC scope inheritance work?
An assignment at a higher scope is inherited by lower scopes. For example, a role assigned at subscription scope normally applies to its resource groups and resources. Assign at resource-group or resource scope when broad access is unnecessary.