medium10 pts · first answer countscloud-securityazure-rbac

Azure NotActions is not a deny

An Azure custom role has Actions "*" and NotActions "Microsoft.Authorization/*/write". A user has this role and also the Owner role on the same scope. Can they create role assignments?

A.Yes, because NotActions only removes permissions from that one roleB.No, because NotActions acts like an explicit denyC.No, because custom roles always take priority over built-in rolesD.Only if they also have a Key Vault access policy

Discussion 0

Join free to post in the discussion.

Azure NotActions is not a deny

Discussion 0

Related questions