azure-rbaclisted

# Azure RBAC: Comprehensive Reference and Patterns ## The Four Pillars Every Azure RBAC operation resolves to four interlocking concepts: 1. **Security principal** — the identity requesting access. Four types: - **User** — individual Entra ID profile (including B2B guests) - **Group** — Entra ID group; role assignments are transitive through nested groups - **Service principal** — application identity for code and automation - **Managed identity** — Azure-managed service principal with automatic credential lifecycle 2. **Role definition** — a named collection of permissions specifying allowed operations at control and data planes. Azure ships 250+ built-in roles; tenants can create up to 5,000 custom roles. 3. **Scope** — the boundary where access applies. Strict hierarchy: **management group → subscription → resource group → resource**. Permissions cascade downward automatically. 4. **Role assignment** — binds one role definition to one security principal at one scope. Permissions are the additive union of all assignments. There is no implicit deny. --- ## Control Plane vs Data Plane — The #1 Production Incident Source Azure operations split into two layers that NEVER cross: **Control plane** — requests to `https://management.azure.com`. Creates, configures, and deletes Azure resources. ARM handles authorization. **Data plane** — requests to resource-specific endpoints (`https://myaccount.blob.core.windows.net`, `https://myvault.vault.azure.net`). Uses