At Cascade Regional Airlines, a cloud administrator is assigned the Reader role at the management group level and separately assigned the Contributor role directly at the maintenance-records resource group beneath that management group. What is the administrator's effective permission on resources inside the maintenance-records resource group?
Select an answer to reveal the explanation.
Short Explanation
Azure RBAC doesn't pick a winner between overlapping roles the way a strict override system would; instead it stacks every permission you've been granted from every applicable scope. If one assignment gives you Contributor somewhere in the stack, that access applies there.
Full Explanation
Azure RBAC evaluates access by collecting every role assignment that applies to a given resource, including ones inherited from parent scopes like management groups and subscriptions, and combining them additively. There is no concept of a higher scope's role suppressing or overriding a role granted closer to the resource; both apply simultaneously, and the union of their permitted actions defines what the principal can actually do. In this scenario, the administrator inherits Reader from the management group on every resource beneath it, and separately holds Contributor directly on the maintenance-records resource group, so within that resource group the broader Contributor actions are available alongside the narrower Reader ones. The notion that a management-group-level assignment always wins misapplies how Azure Policy's deny effects can behave, which is a different system with different precedence rules, to RBAC, which has none. Azure RBAC also does not treat overlapping assignments as an error condition requiring resolution; conflicting or overlapping grants are entirely normal and expected. As a caveat, explicit Azure RBAC deny assignments do exist, primarily surfaced through Azure Blueprints, and those do take precedence over any allow, but no deny assignment is described here. Confirm effective access for a specific resource using the "Check access" feature on its Access control (IAM) blade.