Free guides, interview Q&As, and job responsibility breakdowns — curated by industry veterans to help you crack MNC interviews
Figure 2: Built-in role permission matrix — Owner, Contributor, Reader, User Access Administrator
Azure RBAC
Definition: Azure's authorization system that assigns permissions to identities based on their role, rather than granting full access to everyone.
Day-to-Day Example: Like a hotel issuing different keycards to housekeeping, maintenance, and management, each opening only the doors relevant to their job.
Security Principal
Definition: The identity — User, Group, Service Principal, or Managed Identity — that receives permissions in Azure RBAC.
Day-to-Day Example: Like the specific person or department listed as the recipient on an official building access badge.
Role Definition
Definition: A collection of permissions that specifies exactly what actions a Security Principal is allowed to perform.
Day-to-Day Example: Like the printed list of doors a particular keycard type is authorized to unlock.
Scope
Definition: The boundary — Management Group, Subscription, Resource Group, or Resource — within which a role assignment applies.
Day-to-Day Example: Like specifying whether a keycard works for one room, one floor, or the entire building complex.
Owner (Built-in Role)
Definition: The highest-privilege built-in role, allowing full resource management plus the ability to assign roles to others.
Day-to-Day Example: Like the building owner who holds the master key and also decides who else gets keys.
Contributor (Built-in Role)
Definition: A built-in role allowing full resource management (create, modify, delete) but not assigning roles or managing access.
Day-to-Day Example: Like a facilities manager who can rearrange, renovate, or remove anything in the building, but can't issue new keycards.
Reader (Built-in Role)
Definition: A built-in role providing view-only access to resources, with no ability to create, modify, or delete anything.
Day-to-Day Example: Like a building inspector who can walk through and observe every room but isn't allowed to touch or move anything.
User Access Administrator (Built-in Role)
Definition: A built-in role focused solely on managing who has access — assigning and removing role assignments — without managing resources.
Day-to-Day Example: Like the security office that issues and revokes keycards, but never touches what's actually inside the rooms.
Custom Role
Definition: A user-defined role created by an administrator with a specific, tailored set of permissions not available in any built-in role.
Day-to-Day Example: Like a specially designed keycard made just for the cleaning crew — it opens supply closets and hallways, but nothing else.
Management Group
Definition: The highest level of RBAC scope, used to organize and govern multiple Azure Subscriptions under one hierarchy.
Day-to-Day Example: Like a corporate headquarters overseeing several regional branch offices, applying the same company-wide rules to all of them.
Subscription (RBAC Scope)
Definition: A billing and management boundary containing Azure resources; the second level of RBAC scope.
Day-to-Day Example: Like one specific branch office of a company, with its own budget and its own set of rooms and equipment.
Resource Group (RBAC Scope)
Definition: A logical container holding related Azure resources; the third level of RBAC scope.
Day-to-Day Example: Like one department's floor within a branch office, holding all of that department's rooms and equipment together.
Resource (RBAC Scope)
Definition: An individual Azure service, like one Virtual Machine or Storage Account; the narrowest level of RBAC scope.
Day-to-Day Example: Like a single specific room within that department's floor.
Principle of Least Privilege (PoLP)
Definition: A security principle stating that every user or application should receive only the minimum permissions needed for their task.
Day-to-Day Example: Like giving a delivery driver a keycard that opens only the loading dock, not the entire office building.
Scope Hierarchy
Definition: The nested structure — Management Group > Subscription > Resource Group > Resource — through which RBAC permissions flow and inherit downward.
Day-to-Day Example: Like a company's org chart, where a policy set at headquarters automatically applies down through every branch, department, and desk.
Azure AD Connect
Definition: Microsoft's synchronization tool that connects On-Premises Active Directory with Microsoft Entra ID.
Day-to-Day Example: Like a courier constantly shuttling updated employee records between a company's local HR office and its cloud headquarters.
Password Hash Synchronization (PHS)
Definition: An Azure AD Connect feature that syncs a secure hash of on-prem passwords to Microsoft Entra ID for cloud sign-in.
Day-to-Day Example: Like giving a branch office a coded copy of the master keys so they can verify visitors themselves, without calling headquarters each time.
Pass-Through Authentication (PTA)
Definition: An Azure AD Connect feature that validates sign-ins directly against on-premises Active Directory without storing password hashes in the cloud.
Day-to-Day Example: Like a cloud receptionist who always calls back to the main office to confirm a visitor's identity rather than keeping a copy of the keys.
Seamless Single Sign-On (SSO)
Definition: An Azure AD Connect feature letting users already signed in to their corporate computer access Azure/Microsoft 365 without signing in again.
Day-to-Day Example: Like an employee badge that automatically opens every door they walk up to, without needing to swipe again at each one.
Hybrid Identity
Definition: An identity model integrating on-premises Active Directory with Microsoft Entra ID so users access both environments with one identity.
Day-to-Day Example: Like a single company ID badge that works at both the physical office building and the company's remote branch locations.
1. Authentication vs. Authorization (RBAC Context)
Feature Authentication Authorization Confirms Who are you? What are you allowed to do? Order Happens first Happens after, via Azure RBAC Example Signing in to the Azure Portal Creating or managing Azure resources
2. Owner vs. Contributor vs. Reader vs. User Access Administrator
Permission Owner Contributor Reader User Access Admin View resources Yes Yes Yes Yes Create/modify/delete resources Yes Yes No No Assign RBAC roles Yes No No Yes Manage resource access Yes No No Yes
3. Built-in Role vs. Custom Role
Feature Built-in Role Custom Role Created by Microsoft The organization/administrator Permissions Predefined, fixed Customized to exact requirements Modifiable? Cannot be modified Can be adjusted as needed Best for Common administrative tasks Specific business requirements
4. Management Group vs. Subscription vs. Resource Group vs. Resource
Scope Level Represents Example Management Group Highest — organizes multiple subscriptions "Company-IT" grouping Dev, Test, Prod subscriptions Subscription Billing/management boundary Development Subscription Resource Group Logical container for related resources HR-RG, Finance-RG Resource Narrowest — a single service One specific Virtual Machine
5. Role Assigned at Subscription vs. Resource Group Level
Feature Subscription-Level Role Resource-Group-Level Role Applies to Every Resource Group and Resource in the subscription Only resources within that one Resource Group Scope size Broader Narrower Typical use Department/project-wide administrators Project- or team-specific access
6. Password Hash Synchronization vs. Pass-Through Authentication
Feature PHS PTA Where authentication happens In the cloud (Microsoft Entra ID) On-premises, via secure agent Password hash stored in cloud? Yes No Works if on-prem AD is down? Yes, still functions No, authentication fails
7. Azure AD Connect vs. Hybrid Identity
Concept Azure AD Connect Hybrid Identity What it is The synchronization tool itself The overall identity model/outcome Role Performs the actual sync between AD and Entra ID Describes users having one identity across on-prem and cloud
8. PoLP-Compliant Access vs. Over-Privileged Access
Feature PoLP-Compliant (Reader for an intern) Over-Privileged (Owner for everyone) Risk if compromised Low — limited to viewing High — full control of everything Accidental change risk Very low High Administrative complexity Slightly more roles to manage Simpler, but far less secure
9. Security Principal Types Compared
Type Represents User An individual person's account Group A collection of users managed together Service Principal An identity used by an application or service Managed Identity An identity automatically managed by Azure for its own services
10. Reader Role vs. Contributor Role for Monitoring Tasks
Feature Reader Contributor Appropriate for a monitoring-only intern? Yes — exactly matches the need No — grants unnecessary create/modify/delete rights Can accidentally break something? No Yes, if misused
Q1. What is Azure RBAC, and what principle does it follow?
Answer: Azure RBAC is Azure's authorization system that assigns permissions to identities based on their role, following the principle of "Right User, Right Role, Right Resource" instead of giving everyone full access.
Q2. What are the three core components of Azure RBAC, and how do they work together?
Answer: Security Principal (who), Role Definition (what permissions), and Scope (where it applies) — Azure only grants access once all three are combined in a role assignment.
Q3. What is a Security Principal, and what types can it be?
Answer: A Security Principal is the identity receiving permissions in RBAC, and it can be a User, Group, Service Principal, or Managed Identity.
Q4. What is the difference between the Owner and Contributor built-in roles?
Answer: Both can fully manage resources (create, modify, delete), but only the Owner can additionally assign roles to other users and manage access — Contributor cannot.
Q5. What can the Reader role do, and what can't it do?
Answer: The Reader role can only view resources and their configuration; it cannot create, modify, or delete any resources.
Q6. What is the User Access Administrator role responsible for?
Answer: It manages RBAC role assignments — who has access to what — but does not provide permission to manage or modify the resources themselves.
Q7. When would an organization create a Custom Role instead of using a built-in role?
Answer: When no built-in role matches their exact requirement — for example, wanting users to start/stop VMs but not delete them, which doesn't match either Reader or Contributor precisely.
Q8. What are the four levels of RBAC Scope, from highest to lowest?
Answer: Management Group, Subscription, Resource Group, and Resource.
Q9. How does permission inheritance work across the RBAC scope hierarchy?
Answer: Permissions assigned at a higher scope automatically apply to everything below it — a Management Group role applies to all its Subscriptions, a Subscription role applies to all its Resource Groups and Resources, and so on.
Q10. What is the Principle of Least Privilege (PoLP), and why does it matter?
Answer: PoLP means giving every user only the minimum permissions needed for their job; it matters because it limits the potential damage from accidental mistakes or a compromised account.
Q11. What is a Management Group used for?
Answer: A Management Group organizes multiple Azure Subscriptions under one hierarchy, letting administrators apply RBAC roles and Azure Policies to all of them at once instead of configuring each individually.
Q12. What is Azure AD Connect, and what problem does it solve?
Answer: Azure AD Connect is Microsoft's synchronization tool connecting On-Premises Active Directory with Microsoft Entra ID, solving the problem of maintaining separate, duplicate user accounts in both environments.
Q13. What authentication features does Azure AD Connect support?
Answer: Password Hash Synchronization (PHS), Pass-Through Authentication (PTA), and Seamless Single Sign-On (SSO).
Q14. What is Hybrid Identity, and how does it relate to Azure AD Connect?
Answer: Hybrid Identity is the overall model where a user has one identity across both on-premises and cloud resources; Azure AD Connect is the actual tool that performs the synchronization making Hybrid Identity possible.
Q15. What is the difference between Authentication and Authorization in the context of Azure RBAC?
Answer: Authentication verifies who a user is (e.g., signing in with credentials), while Authorization — governed by Azure RBAC — determines what that authenticated user is allowed to do with Azure resources.
Q1. A company wants an IT Administrator to have full control over Azure resources, including assigning roles to others. Which built-in role should be assigned?
Answer: The Owner role should be assigned, since it's the only built-in role that combines full resource management with the ability to assign roles to other users.
Q2. A developer needs to create, modify, and delete Virtual Machines but should never be able to grant other people access. Which role fits?
Answer: The Contributor role fits, since it allows full resource management but explicitly does not permit assigning roles or managing user access.
Q3. An auditor needs to review Azure resource configurations but must never be able to change anything, even accidentally. Which role fits?
Answer: The Reader role fits, since it provides view-only access with no ability to create, modify, or delete resources.
Q4. A security administrator's only job is to assign and remove access for other employees, without touching the resources themselves. Which role fits?
Answer: The User Access Administrator role fits, since it's designed specifically to manage RBAC role assignments without providing resource management permissions.
Q5. A company wants developers to start and restart VMs and view resource groups, but never delete VMs or assign roles. No built-in role matches exactly. What should be created?
Answer: A Custom Role should be created containing exactly those permissions (start/restart VMs, view resource groups) while excluding delete and role-assignment permissions.
Q6. An administrator assigns the Contributor role to Rahul at the Development Resource Group level. Can Rahul manage resources in the Production Resource Group?
Answer: No — since the role was assigned at the Resource Group scope (Development), Rahul's permissions are limited to that specific Resource Group and don't extend to Production unless a separate role is assigned there.
Q7. A multinational company has separate Azure Subscriptions for its India, US, and UK offices and wants the same security roles and policies applied to all three at once. What should they create?
Answer: They should create a Management Group, place all three Subscriptions inside it, and assign roles/policies at the Management Group level so they're automatically inherited by all three Subscriptions.
Q8. A company has an existing On-Premises Active Directory and wants employees to use the same username and password for both office computers and Microsoft 365/Azure. What should they implement?
Answer: They should implement Hybrid Identity using Azure AD Connect, which synchronizes on-premises AD accounts with Microsoft Entra ID, allowing a single identity to work across both environments.
