Diagram
A decision tree showing how Azure Resource Manager evaluates access requests by checking deny assignments first, calculating additive permissions by subtracting NotActions from Actions, and evaluating conditions to determine final access.
Evaluation Logic and Formulas
When an identity requests access, the Azure Resource Manager retrieves all applicable role and deny assignments to perform a multi-step evaluation. The system evaluates deny assignments first, as any matching deny will immediately block access regardless of other allowed permissions. If no deny assignment exists, the system calculates access by subtracting NotActions from Actions to find the effective management permissions. For systems like Azure Data Lake Storage, the system evaluates Access Control Lists (ACLs) in tandem with RBAC to determine fine-grained file access.
Domain 3 of 3
38 practice questions
Practice this DomainLast updated