Role-based access control is how you can manage access to resources in Azure. As you navigate through Azure, from the management group, subscription, resource group all the way down to the individual resources, you will notice a blade called Access Control IAM. This is where you can view, add and remove role assignments. Let's go to the Azure portal and see how we can view, add and remove these role assignments. Here we are in the Azure portal under Resource Groups. Let's select our resource group and we will notice that we have a virtual machine that is already deployed. Let's give access to Ari as he is tasked with managing all virtual machines in this resource group. Click on Access Control. To add a role assignment, we can add it by clicking on the Add button on the right-hand side or we can hit the Add Role Assignment in the menu bar. Under Role, we will see a list of all the built-in roles possible. And we'll scroll all the way down to Virtual Machine Contributor. In the Select field, we can search for Ari's name, select his name and hit Save. Now Ari has access to this user's group and to manage the virtual machine. 

We can check Ari's access by typing in his name. And here we'll see the results of the access that he has. We can close that. As well as you can go to Role Assignments. Here we'll see all of the role assignments for the resource group. Some of them are inherited and Ari is at the bottom, we're a virtual machine contributor for this resource group. We can remove Ari's access by selecting his user and clicking Remove. In this short demo, we added our user, Ari, to the virtual machine contributor role. We then verified his access by going to Check Access and reviewed the Role Assignments tab. We then finished off by removing the role assignment to the resource group.