Inheritance, permissions and remediation

Grants and exclusions

Azure RBAC combines applicable grants. NotActions removes operations from a role definition; it is not a global denial against permissions from another role. An applicable deny assignment is a different mechanism.

Access removal therefore requires inventorying direct assignments, groups and inheritance. Adding Reader does not restrict Contributor. After adjusting grants, confirm a required operation and one that must be denied.

Scope does not replace actions

A role combines operations with scope. Assigning VM Contributor at a management group permits descendant VM administration according to its definition, but does not make it universal hierarchy administration. When moving a subscription between management groups, compare ancestry, inherited Policies and RBAC.

Stable resource IDs do not demonstrate unchanged controls for creation, modification and recovery. Prepare the team receiving operational responsibility.

Identity performing the correction

Policy evaluation can identify noncompliance without correcting existing resources. Modify and deployIfNotExists use the assignment identity for remediation. SDK-created assignments need appropriate grants; permissions of the operator reading the report do not replace that identity’s permissions.

Changing roleDefinitionIds in the definition also does not prove automatic grant updates for existing identities. Review minimum actions and confirm the resource outcome.

Tags and change exercise

Group or subscription tags are not automatically copied to every resource. Define application, remediation and querying consistently with inventory. Because tags can appear in APIs and reports, do not store API keys in them.

In the exercise, a migration changes hierarchy and support team. Produce a list of inherited permissions, Policies that could block future requests, missing tags and expected remediation results. Do not approve the change merely because resource count stayed unchanged.

Common pitfalls

Avoid treating NotActions as global deny, operator permissions as runner permissions, and group tags as inherited resource tags.