Lab — Prove that inheritance only flows one way
AZ-104 › Unit 1 › Lab
Lab — Prove that inheritance only flows one way
Lab brief
- AZ104-U1.T2
- 25 minutes
- Two resource groups, a role assignment, a custom role definition
- required
- Core
The claim to make physical: you cannot narrow an inherited assignment from below. Everybody knows lower levels inherit from higher. Far fewer have watched an attempt to subtract fail.
Before you start
A subscription where you can create role assignments — that needs Owner or User Access Administrator on it. Resource groups and role definitions are free; nothing here deploys a billable resource.
Walkthrough
Prove that inheritance only flows one way
1. Create two resource groups
az group create --name bb-lab-rbac-a --location westeurope and again for bb-lab-rbac-b. A resource group holds metadata about resources, so its location is where that metadata lives — resources inside one may sit in different regions.
Did it teach you what it was meant to?
A principal has Reader at the subscription. You need them to keep reading resource group A but lose access to B. What does step 3 show you must do?
Step 5 showed the boundary between two built-in roles. Which requirement does Contributor fail?
What goes wrong
Tear it down
Run this whether or not the lab worked. Everything above was chosen to cost approximately nothing, and leaving it in place is how approximately nothing becomes something.
Teardown
Remove the assignment, then the resource groups
az role assignment delete for anything left, then az group delete --name bb-lab-rbac-a and the same for bb-lab-rbac-b. Deleting the resource groups removes anything inside them.
Where these figures come from
Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.
| Document | sha1 |
|---|---|
| Manage Azure resource groups by using Azure CLI | a3840d837a3d |
| Manage Azure resource groups by using the Azure portal | c2bc52250166 |
| Understand scope for Azure RBAC | 87e7f6fe1b69 |
| Assign Azure roles using Azure CLI | b29025fd43e6 |
| Create or update Azure custom roles using Azure CLI | 7b5d855bd425 |
| Azure built-in roles | 068bc2c7255f |
| List Azure deny assignments | f4d5fba1f410 |