CODEWITHSUNDEEP
azureazure-resource-managerazure-rbac
Gaurav Mantri
Gaurav Mantri

Reputation: 136196

Is a user with "Contributor" and "User Access Administrator" roles same as a user with "Owner" role?

So we have got 3 built-in roles: Owner, Contributor and User Access Administrator.

Considering a Contributor can do everything in an Azure Subscription except RBAC role assignment and a User Access Administrator can do RBAC role assignment, can we assume that if a user is assigned both Contributor and User Access Administrator roles at a particular scope (e.g. Subscription), they are effectively an Owner for that scope?

Or are there certain things that still only an Owner can do?

Upvotes: 5

Views: 3809

Answers (1)

Thomas
Thomas

Reputation: 29522

If we look at the permissions:

  • A Owner can do anything: "actions": ["*"].
  • A User Admin can only read anything (except secret), manage roles and create and update support tickets: "actions": ["*/read", "Microsoft.Authorization/*", "Microsoft.Support/*"]
  • A contributor can do anything except managing roles, managing blueprint assignment and sharing a gallery to different scopes 
    "actions": [
  "*"
],
"notActions": [
  "Microsoft.Authorization/*/Delete",
  "Microsoft.Authorization/*/Write",
  "Microsoft.Authorization/elevateAccess/Action",
  "Microsoft.Blueprint/blueprintAssignments/write",
  "Microsoft.Blueprint/blueprintAssignments/delete",
  "Microsoft.Compute/galleries/share/action"
],

So a user with Contributor and User Access Administrator roles is missing some permissions compared to the Owner Role: Can't create/delete blueprint and can't share gallery to different scopes

Upvotes: 7

Related Questions