AZ-104 AZ-305 Least privilege

RBAC Roulette 🎯

Tickets land. You pick the role and the scope. Over-grant and the alarm goes off and your blast radius lights up red. Under-grant and it bounces back while the queue keeps filling. Nobody in this game gets Owner because it was faster.

The Rules of the Help Desk
  • Every ticket needs two answers: the role, and the scope you put it at.
  • Over-permission = alarm, security score drops, blast radius animates outward. Combo dies.
  • Under-permission = the ticket bounces back into the queue with less patience left.
  • The queue has a limit — 7 pending at Foundation, 4 at Architect. One arrival past it ends the run.
  • Security score hits zero and the CISO ends the run for you.
  • Every 5 solved tickets = next wave. Tickets arrive faster, patience gets shorter.
  • The tier sets the pressure: option count, patience, penalties, queue limit and score multiplier all move with it. Best scores are kept per tier.
Combo math
3 clean tickets in a row = 1.5×
6 in a row = 2× · 9 = 2.5× … caps at 4×.
Answering fast adds a time bonus. Answering correctly adds a lot more.

Keyboard: 1234 pick the role (fewer options at the lower tiers) · ASDF pick the scope · Space next ticket. Touch: just tap.

Expert

—

AZ-104 track personal best: —
▸ What this drills (and where to go read it)

Concepts in the bank

  • Control plane vs data plane — the single biggest RBAC trap. Reader ≠ can read blobs.
  • Built-in role look-alikes — VM Contributor vs VM User Login vs VM Administrator Login; Storage Account Contributor vs Storage Blob Data *; Key Vault Contributor vs Key Vault Secrets User.
  • Key Vault RBAC vs access policies — which permission model is in play, and why one silently ignores the other.
  • User Access Administrator & RBAC Administrator — granting access without granting the resources.
  • Entra ID roles vs Azure RBAC roles — Global Administrator has no Azure control-plane rights until it elevates.
  • PIM — eligible vs active, activation, approval, time-bound assignments.
  • Custom roles — when Actions/NotActions are needed, assignableScopes, and the DataActions limits.
  • Deny assignments — the thing that beats Owner.
  • Scope selection — management group vs subscription vs resource group vs resource, and inheritance.
  • Ops roles — Monitoring Reader/Contributor, Metrics Publisher, Backup Operator vs Contributor, Cost Management, Reservations.

Whiteboards that cover it

Sister game

  • Blast Radius — same hierarchy, but policy, locks and inheritance instead of roles.