Assign administrator permissions – Manage Azure identities and governance – AZ-104 Study Guide

Assign administrator permissions

Azure has many different roles for managing access to Azure resources. These include classic subscription administrative roles like Account Administrator, Service Administrator, or Co-Administrator, as well as Azure role-based access controls (RBAC) that are available in Azure Resource Manager (ARM). Note that classic roles and resources are scheduled to be

deprecated in August 2024. When managing access to Azure subscriptions and resources, it is recommended to use Azure RBAC roles whenever possible.

NEED MORE REVIEW? ROLES AND RELATIONSHIPS

To learn more about the correlation between classic subscription administrator roles,

Azure RBAC roles, and Entra roles, see https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles.

Classic subscription administrators have full access to an Azure subscription. They can manage resources through the Azure portal, Resource Manager APIs (including through PowerShell and the CLI), and the classic deployment model APIs.

By default, the account that is used to sign up for an Azure subscription is automati- cally set as both the Account Administrator and the Service Administrator. They both are authorized to perform subscription management activities, but creation of new Azure subscriptions and billing changes can be performed only by the Account Administrator. There can be only one Account Administrator per account and one Service Administrator per subscription.

Once the subscription has been created, more Co-Administrators can be added. The Co- Administrator has the same level of access as the Service Administrator but cannot change the association of subscriptions to Azure directories. There can be up to 200 Co-Administrators per subscription.

Users assigned with the Service Administrator and Co-Administrator roles have the same access as a user who is assigned the Azure RBAC Owner role at the subscription scope.

In the Azure portal, you can view the current assignments for the Account Administrator and Service Administrator roles by browsing to a subscription in the Azure portal and selecting the Properties blade, as seen in Figure 1-51.

FIGURE 1-51 Azure subscription properties

Built-in Azure RBAC roles

Azure RBAC roles are more flexible than classic administrator roles and allow for more fine- grained access management. Azure RBAC has more than 70 built-in roles, but there are four foundational roles, as shown in Table 1-4.

TABLE 1-4 Azure RBAC roles

Azure RBAC role	Permissions	Notes
Owner	Full access to all resourcesDelegate access to others	The Service Administrator and Co- Administrators are assigned the Owner role at the subscription scope.Applies to all resource types.
Contributor	Create and manage all types of Azure resourcesCannot grant access to others	Applies to all resource types.
Reader	View Azure resources	Applies to all resource types.
User Access Administrator	Manage user access to Azure resources