Azure (RBAC) includes built-in roles that you can assign to users, groups, services principals and managed identities.
- A service principal is an identity that can be created for an application or service to access Azure resources.
- A managed identity is a type of service principal that is managed by Azure by default. It could be System-Assigned or User-Assigned.
Key built in roles:
- Owner: full access to all resources, including the ability to assign roles.
- Contributor: cannot assign roles but have full access to manage all resources
- Reader: can see but cannot touch (cannot make any change)
- User Access Administrator: can manage user access to Azure resource