Role-based access control

Role-based access control, commonly known as RBAC, is a security framework that manages who can perform what actions on which resources within your Azure subscription by assigning users, groups, or applications to predefined or custom roles with specific permissions. Rather than granting permissions to individual users on a resource-by-resource basis—which quickly becomes unmanageable at scale—RBAC allows you to define roles like Owner, Contributor, Reader, or specialized roles like Virtual Machine Contributor or Storage Account Key Operator, and then assign those roles to security principals at different scopes such as management groups, subscriptions, resource groups, or individual resources. This hierarchical permission model follows the principle of least privilege, ensuring that users have exactly the access they need to perform their job functions without over-provisioning permissions that could pose security risks. RBAC integrates seamlessly with Azure Active Directory, supports custom role definitions for unique organizational requirements, maintains detailed audit logs of all access assignments, and provides a consistent authorization mechanism across all Azure services, making it the cornerstone of Azure's identity and access management strategy.