You have an Azure subscription. You plan to create a custom role-based access control (RBAC) role that will provide permission to read the Azure Storage account. Which property of the RBAC role…

Question

Options

• ANotActions []
• BDataActions []
• CAssignableScopes []
• DActions []

• A
  2% (1)
• B
  2% (1)
• C
  4% (2)
• D
  91% (41)

Explanation

RBAC Role Definition – Actions Property

Option D (Actions []) is correct because the Actions property defines the management plane permissions that a role is allowed to perform, including reading Azure resource metadata such as Storage account properties. When you want to grant permission to read a Storage account (i.e., view its configuration and properties via Azure Resource Manager), you add the appropriate management operation (e.g., Microsoft.Storage/storageAccounts/read) to the Actions array.

Why the distractors are wrong:

• A (NotActions []) is used to exclude specific permissions from the Actions set - it defines what the role cannot do, not what it can.
• B (DataActions []) applies to data plane operations (e.g., reading/writing blob data inside a storage account), not management-level read access to the account itself.
• C (AssignableScopes []) defines where the role can be assigned (e.g., subscription, resource group), not what the role is permitted to do.

Memory Tip: Think "Actions = Allow access" - if you want to grant a management-level permission, it goes in Actions []. Use DataActions only when dealing with the contents of a resource (data), not the resource itself.

No community discussion yet for this question.