A municipal architect notes that Azure RBAC is often confused with Entra app single sign-on. What does Azure RBAC primarily authorize?
Select an answer to reveal the explanation.
Short Explanation
SSO gets you through the front door of apps; RBAC decides what you can do to Azure resources once you are operating in Azure. Think "can this group restart that VM" versus "can they sign into Outlook." Different jobs.
Full Explanation
Azure RBAC primarily authorizes management-plane actions on Azure resources—create, read, update, delete, and related control operations—according to the role definition assigned to a principal at a scope. Examples include starting a virtual machine, changing a network security group rule, or reading resource configuration in the portal or via API. That is distinct from Microsoft Entra application single sign-on, which focuses on authenticating users into applications with a shared identity session. SSO answers “can this user sign into the app?” while Azure RBAC answers “what Azure resource operations may this principal perform, and where?”
RBAC is not limited to end-user passwords for consumer social media applications. It does not automatically expose every storage account to the public internet; public access is a separate storage configuration concern. It also is not DNS name resolution inside on-premises Active Directory forests—that is directory/DNS infrastructure, not Azure management-plane authorization.
Exam caveat: when a question mentions assigning Owner, Contributor, or Reader on a subscription or resource group, the topic is Azure RBAC—even if Entra ID is how users authenticate to the portal.
Operational check: pick a test principal, assign Contributor at a resource-group scope and deny higher scopes, then attempt a resource change inside that group versus outside it to confirm RBAC scope boundaries behave as designed.