Direct answer
Azure role assignments apply at a scope and can be inherited by child resources. Compare effective access with the task and resource boundary the principal actually needs.
Map principal, role and scope
List the in-scope management groups, subscriptions, resource groups and resources. For each relevant assignment record the principal, role, scope, owner and business purpose. Distinguish human, service principal and managed identity access.
Reference: Microsoft: Understand scope for Azure RBAC.
Inspect inherited access
For an identity that only manages one storage account, check whether a subscription-level assignment also grants access to unrelated resources. Review inherited assignments and relevant deny assignments or conditions rather than reading only the resource's direct role list.
- Record scope and assignment source.
- Review privileged custom roles and their actions.
- Check time-limited access and emergency roles separately.
Test with controlled identities
Use a dedicated test principal to verify one required action on an approved test resource and a denied action outside its intended scope. Avoid modifying production resources. An access denial may result from multiple policy layers, so identify the effective reason where possible.
Narrow and retest
Pilot a resource-level assignment, verify required operations and remove the broader grant through an approved change. Account for propagation and check both intended access and an unrelated resource after rollout.
Assessment limits
Effective Azure access depends on role assignments, scopes, conditions, deny assignments and service-specific authorization. One test identity does not establish access for every group member.
Frequently asked questions
Does a resource show all access granted above it?
Review inherited assignments and other applicable controls as well as assignments made directly on the resource.
Does a role name define its resource scope?
No. The role defines permissions; the assignment scope determines where those permissions apply.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.