Managing Built-in Azure Roles

Azure (RBAC) includes built-in roles that you can assign to users, groups, services principals and managed identities.

• A service principal is an identity that can be created for an application or service to access Azure resources.
• A managed identity is a type of service principal that is managed by Azure by default. It could be System-Assigned or User-Assigned. 

Key built in roles:

• Owner: full access to all resources, including the ability to assign roles.
• Contributor: cannot assign roles but have full access to manage all resources
• Reader: can see but cannot touch (cannot make any change)
• User Access Administrator: can manage user access to Azure resource