Skip to content

Enhance role-definitions.md with control plane examples #128683

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Rafael Fernández (rfernandezdo) wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Enhance role-definitions.md with control plane examples #128683

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions articles/role-based-access-control/role-definitions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -335,9 +335,23 @@ The following table shows two examples of the effective control plane permission
> | `Microsoft.CostManagement/exports/*` | *none* | `Microsoft.CostManagement/exports/action`</br>`Microsoft.CostManagement/exports/read`</br>`Microsoft.CostManagement/exports/write`</br>`Microsoft.CostManagement/exports/delete`</br>`Microsoft.CostManagement/exports/run/action` |
> | `Microsoft.CostManagement/exports/*` | `Microsoft.CostManagement/exports/delete` | `Microsoft.CostManagement/exports/action`</br>`Microsoft.CostManagement/exports/read`</br>`Microsoft.CostManagement/exports/write`</br>`Microsoft.CostManagement/exports/run/action` |

The following table shows additional examples of effective control plane permissions when `Actions` and `NotActions` overlap:

> [!div class="mx-tableFixed"]
> | Actions | NotActions | Effective control plane permissions |
> | --- | --- | --- |
> | `*`</br>`Microsoft.Network/virtualNetworks/subnets/join/action` | `Microsoft.Network/*` | All control plane permissions except `Microsoft.Network/*`</br>`Microsoft.Network/virtualNetworks/subnets/join/action` is excluded |
> | `Microsoft.Authorization/*/read` | `Microsoft.Authorization/*/read` | *none* |
Comment on lines +343 to +344

These examples highlight two important behaviors:

- An action explicitly listed in `Actions` is still excluded if it matches any pattern in `NotActions`.
- A broader pattern in `NotActions`, such as `Microsoft.Network/*`, excludes all matching actions in that role, including actions that are also listed explicitly in `Actions`.

> [!NOTE]
> If a user is assigned a role that excludes an action in `NotActions`, and is assigned a second role that grants access to the same action, the user is allowed to perform that action. `NotActions` is not a deny rule – it is simply a convenient way to create a set of allowed actions when specific actions need to be excluded.
>
> Also note that `NotActions` only excludes actions that match valid Azure resource provider operations. If an entry in `NotActions` does not correspond to a valid operation pattern, it does not exclude anything in practice. For this reason, both `Actions` and `NotActions` should be validated against the current Azure resource provider operations catalog.

### Differences between NotActions and deny assignments

Expand Down