Skip to content

Azure RBAC vs Policy vs resource locks

Compare permissions, compliance and resource protection for AZ-104, with practical scenarios and free questions.

Read the guide
Read, then practise

Compare the concepts, work through a scenario and check your answer.

AZ-104 guide · no account required

Choose the control for the requirement

Azure RBAC grants an identity permissions at a scope. Azure Policy evaluates organizational requirements. Resource locks protect management operations from deletion or modification. A deployment can require all three controls.

Choose the control for the requirement
ControlTypical requirement
Azure RBACLet a team manage resources in one resource group
Azure PolicyRestrict deployments to approved regions
Resource lockPrevent accidental deletion of a resource

Permissions and compliance work together

Contributor can manage resources but cannot assign Azure roles. Owner can also delegate access. Role Based Access Control Administrator can manage role assignments without the other permissions that Owner or User Access Administrator carry. Use the smallest scope and permissions that satisfy the task.

A policy initiative groups definitions for assignment together. Audit reports violations; deny can reject a noncompliant deployment. Granting Owner does not bypass a deny policy. Existing resources can require remediation, depending on the effect.

Understand lock boundaries

CanNotDelete allows changes but blocks deletion. ReadOnly blocks management updates as well as deletion, and can disrupt operations implemented as POST requests. Locks inherit from parent scopes and apply to the control plane, not data operations such as deleting a blob.

An authorized user can remove a lock. It is a guard against mistakes, not a substitute for least-privilege access. For an exam scenario, distinguish who can act, what configuration is permitted, and which management changes must be protected.

Check your understanding

Question 1Delegating Azure RBAC

User1 has the Contributor role at the scope of subscription Sub1, which contains resource group RG1. User1 must be able to grant colleagues Azure role assignments for the resources in RG1, but must not be able to manage access anywhere else in Sub1 or change governance settings such as policy assignments or locks. You can create one additional role assignment for User1. Which assignment follows the principle of least privilege?

  1. Role Based Access Control Administrator at the RG1 scope
  2. User Access Administrator at the RG1 scope
  3. Owner at the RG1 scope
  4. Role Based Access Control Administrator at the Sub1 scope
Show answer and explanation

Correct answer: A · Role Based Access Control Administrator at the RG1 scope

Contributor excludes Microsoft.Authorization write and delete operations, so User1 is missing only the right to create and remove role assignments. Role Based Access Control Administrator adds exactly roleAssignments/write and roleAssignments/delete, and does not allow access to be managed in other ways, such as Azure Policy. Assigned at RG1, it applies only to that resource group, while the subscription-level Contributor role continues to cover resource management. For tighter delegation, you can add a condition that limits which roles User1 can assign.

Why the other choices do not fit

  • User Access Administrator grants Microsoft.Authorization/*. At RG1, that also includes policy assignments, locks, and custom role definitions, which is more than role assignment management requires.
  • Owner at RG1 allows role assignments, but it grants every other Microsoft.Authorization operation as well. User1 already manages resources through Contributor, so Owner adds far more than needed.
  • The role is appropriate, but the scope is not. At Sub1, User1 could assign roles on every resource group in the subscription, breaking the requirement to stay within RG1.
Built-in roles: Contributor, RBAC Administrator, User Access AdministratorDelegate Azure role assignment management with conditions
Question 2Management groups and policy scope

Management groups MG-Finance and MG-Security are both direct children of the Tenant Root Group. MG-Finance contains 10 subscriptions, including Sub1. A custom security-baseline initiative is defined in MG-Security (its definition location) and assigned there. Sub1 must receive the security baseline and continue to inherit every policy and role assignment from MG-Finance. The other nine MG-Finance subscriptions must not be affected. What should you do?

  1. Add MG-Security as a second parent of Sub1, alongside MG-Finance
  2. Move Sub1 from MG-Finance into MG-Security
  3. Assign the existing initiative from MG-Security directly at the Sub1 scope
  4. Save a copy of the initiative with MG-Finance as its definition location, then assign the copy at the Sub1 scope
Show answer and explanation

Correct answer: D · Save a copy of the initiative with MG-Finance as its definition location, then assign the copy at the Sub1 scope

A policy or initiative definition can only be assigned at its definition location or within the hierarchy below it. Sub1 sits under MG-Finance, not MG-Security, so the existing definition is out of reach. A copy defined at MG-Finance can be assigned at the Sub1 scope. Defining it at MG-Finance does not affect the other nine subscriptions because only an assignment applies it. Sub1 keeps its parent and all inherited assignments.

Why the other choices do not fit

  • Each subscription and management group can have only one parent, so the hierarchy remains a tree. A subscription cannot have two parent management groups.
  • Sub1 would receive the baseline, but it would stop inheriting MG-Finance policy and role assignments. That breaks the second requirement.
  • This is the tempting shortcut, but Sub1 is not in the hierarchy under the initiative’s definition location, MG-Security. The assignment is not possible until the definition is available at a scope above Sub1.
Management groups: one parent per subscriptionPolicy definition location

Continue your preparation

Original practice scenarios adapted from the Pass104 question bank, not actual Microsoft exam questions. Consult Microsoft Learn for current service details. Pass104 is independent of Microsoft.