Azure RBAC Roles and Entra Roles

Azure Basics · Governance – Regions, Subscriptions, Policy and RBAC · Lesson 5 of 5

Azure RBAC roles control access to Azure resources at several scopes; Entra roles control objects in the tenant. A Global Administrator has no subscription rights by default.

There are two separate role systems:

	Azure RBAC role	Microsoft Entra role
Manages	Azure resources (VMs, storage, RGs…)	Entra objects (users, groups, apps, domains)
Examples	Owner, Contributor, Reader, User Access Administrator	Global Administrator, User Administrator, Application Administrator, Billing Administrator
Scope	Management group, subscription, RG, resource	Tenant (or Administrative Unit)
Tools	Portal, `az role`, Azure PowerShell, ARM/Bicep, REST	Entra admin center, Microsoft 365 admin center, Microsoft Graph, Microsoft Graph PowerShell

flowchart TB
  subgraph Entra["Tenant: Entra roles"]
    GA["Global Administrator"]
  end
  subgraph ARM["Azure RBAC"]
    Root["Root management group"] --> Sub["Subscriptions"] --> RG["Resource groups"]
  end
  GA -. "elevate access → User Access Administrator at root" .-> Root

A Global Administrator has no rights on subscriptions by default. They can turn on elevate access (Entra → Properties → "Access management for Azure resources") to become User Access Administrator at root / temporarily, assign the rights they need, then turn it off.
Classic administrators (Service Administrator, Co-Administrator) were retired by Microsoft on 31 August 2024; use Azure RBAC instead.
Azure AD PowerShell is retired; use Microsoft Graph PowerShell for Entra roles.

Command	Meaning
`az role assignment list --assignee alice@example.com --all -o table`	All of Alice's Azure RBAC roles in the subscription (Entra roles not included)

More Entra roles you will meet

Role	Typical holder
Privileged Role Administrator	Manages role assignments and PIM in Entra ID
Security Administrator	Security settings, Identity Protection, Defender policies
Helpdesk Administrator	Resets passwords for non-admin users
Global Reader	Reads everything an admin can see, changes nothing
Application Administrator	Manages app registrations and enterprise apps

Prefer these narrow roles over Global Administrator. Microsoft recommends keeping the number of Global Administrators small, ideally fewer than five.

A third system: billing roles

Who can see invoices or create subscriptions is controlled by billing roles on the billing account (for example Billing account owner or Invoice manager in a Microsoft Customer Agreement, or Enterprise Administrator in an EA). They are separate from both Entra roles and Azure RBAC, which surprises many teams when a Global Administrator cannot see the bill.

Emergency access accounts

Create two break-glass accounts with Global Administrator, long random passwords or FIDO2 keys, excluded from Conditional Access rules that could lock everyone out, and monitored with an alert on every sign-in. They exist for the day MFA or federation fails.

Checking what someone holds

Azure RBAC: az role assignment list --assignee <user> --all.
Entra roles: the user's Assigned roles page in the admin center, or Get-MgRoleManagementDirectoryRoleAssignment in Microsoft Graph PowerShell.

Privileged Identity Management (P2) works for both systems: Entra roles and Azure resource roles can each be made eligible, time-bound, and approval-based.