AZ-104 Practice Question 1: RBAC Additive Role Scope
Microsoft Azure Administrator Associate (AZ-104) · Test 1 · question 1 of 10
A user in your Microsoft Entra tenant is assigned the Reader role at the scope of subscription Sub1. Later, you assign the same user the Contributor role at the scope of the resource group RG-Finance, which lives in Sub1.
The user reports that they still cannot create a storage account in RG-Finance and believes the Reader assignment is blocking them. Assuming no deny assignments and no resource locks exist, what are the user's effective permissions on RG-Finance?
Show answer and explanation
Answer:
Azure RBAC is an additive model: when several role assignments overlap, the effective permissions are the union of all of them. Reader at the subscription grants read on everything in Sub1; Contributor at RG-Finance grants create, update, and delete inside that resource group. The sum inside RG-Finance is Contributor, so the user can create the storage account. The real cause of the failure is something else: a stale token that predates the assignment, a resource provider not registered, or an Azure Policy deny effect, not the Reader assignment.
Option A inverts how scope works. A parent-scope assignment is inherited *downward* and adds to child-scope assignments; it never overrides or caps them.
Option C describes network security group or firewall-style evaluation, not Azure RBAC. Only a deny assignment (created by Azure Blueprints or managed applications, not by an administrator assigning a built-in role) can subtract permissions, and the stem rules those out.
Option D is not a behaviour Azure RBAC has. Role assignments are independent objects; they never cancel one another, and removing one has no effect on the others.
Reference: What is Azure role-based access control (Azure RBAC)?