Hello and welcome to key roles. To effectively manage Azure subscriptions and resource groups, you must be familiar with the different RBAC roles. What we're going to do here is take a look at some of the key built-in roles along with some of the other more important RBAC roles.

The four key roles that I want to introduce you to are contributor, owner, reader, and user access administrator. The contributor role is used to grant full access to manage all Azure resources. However, this role does not allow the user to whom it's been assigned to assign roles in Azure RBAC. In other words, a user with a contributor role assigned to him can only manage resources. He cannot assign roles to other users.

The owner role is similar to the contributor role. However, as you might expect, it grants additional permissions. Like the contributor role, the owner role grants the user to whom it's been assigned full access to manage all Azure resources. However, it also allows the user to assign roles to other users in Azure RBAC. The owner role can be viewed as essentially having the keys to the kingdom for whatever resource it applies to.

The reader role is pretty self-explanatory. A user that's been assigned the reader role will be able to view resources or read them, but will not be allowed to make any changes. User access administrators are allowed to manage user access to Azure resources and that's it. They have no access to the actual resources themselves. Rather, they manage the access to those resources.

Now, these four key roles are not by far the only roles that are used to manage Azure subscriptions and resource groups. There are literally dozens or maybe even hundreds of different roles that are available depending on the Azure resource that you're talking about. For example, for compute resources, we have roles like the virtual machine contributor which allows you to manage virtual machines without providing access to them. This role also blocks access to the virtual networks and storage accounts that virtual machines are connected to.

Other compute roles include virtual machine administrator login, virtual machine user login, and classic virtual machine contributor. There are even more built-in roles for networking resources, including network contributor which allows you to manage networks, but not access them.

There are several CDN-related roles as well that allow for different levels of CDN management. There are also several other networking-related roles to choose from. The same thing goes for storage, web, containers, databases, and a host of other types of Azure resources. The URL on your screen provides a complete and updated list of all the different built-in RBAC roles that come into play when managing Microsoft Azure.

Now, I should point out that you aren't going to be expected to memorize a list of hundreds of different roles, that's just not practical, but you should really familiarize yourself with the four key roles that I mentioned earlier. They include the contributor role, the owner role, the reader role, and the user access administrator role.

You should also be aware that in addition to all of these built-in roles, you can create custom roles when necessary as well. That being said, the built-in roles are more often than not sufficient for typical environments. Join me in the next lesson where I'll demonstrate how to add an owner to an Azure subscription.