How does Azure RBAC work? Explain roles, scopes, and assignments.
What they are really testing: Whether you can construct an access grant from its three parts (who, what role, at what scope) and apply least privilege, plus built-in vs custom roles and scope inheritance.
A real interview question
How does Azure RBAC work? Explain roles, scopes, and assignments.
What most people say
drag me
“You assign roles like Owner or Contributor to users to give them access.”
It names roles but not scope, the third essential part, or inheritance, and defaults toward broad roles. RBAC is who plus role plus scope, and least privilege means the narrowest role at the narrowest scope.
The follow-ups they ask next
What is the difference between Owner and Contributor?
Both can manage resources, but Owner can also grant access to others (manage role assignments); Contributor cannot. Prefer Contributor unless the principal genuinely needs to manage access.
Why assign roles to groups instead of individual users?
Manageability and auditability: access follows group membership, so onboarding/offboarding is changing a group, not hunting down per-user assignments across scopes.
What the interviewer is listening for
- Grant = principal + role + scope
- Knows scope inheritance + built-in vs custom
- Least privilege, assigns to groups
What sinks the answer
- Omits scope
- Defaults to Owner
- Assigns only to individuals
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“An RBAC grant is [role + scope + principal]. Role = [a set of actions, built-in (Owner/Contributor/Reader) or custom]. Scope = [management group / subscription / resource group / resource, and it inherits downward]. Assignment = [binds a principal (user/group/SP/managed identity) to a role at a scope]. Least privilege: [narrowest role at the narrowest scope, assign to groups].”
Keep going with azure
Foundation
What is Microsoft Entra ID (formerly Azure AD), and how does authentication work in Azure?
Foundation
In Azure, what handles authentication versus authorization?
Foundation
Explain the Azure resource hierarchy: tenant, management group, subscription, resource group.
Junior
What happens when a user signs in to an Azure/Entra-protected application?
Junior
What is the difference between a service principal and a managed identity, and why prefer managed identities?
Junior
What is Azure Key Vault, and how should an application access a secret from it securely?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free