Azure IAM Role

Handian Sudianto 5,666

Hello,

I assign a user as network contributor and as reader, but why this user is able to doing write operation such as create VM, turn off the VM etc?

2 answers

Manu Philip 18,706 Reputation points MVP

2025-01-15T06:50:43.7433333+00:00

Hi Handian Sudianto,

It's a good idea to evaluate the assigned roles to the user and the group that user belongs. Looks like the user has got some other privilages also

Hope this helps.

--please don't forget to upvote and Accept as answer if the reply is helpful--
Please sign in to rate this answer.
Handian Sudianto 5,666 Reputation points

2025-01-15T06:54:12.8+00:00

hi @Manu Philip

We can see here the user only have role for Network Contributor and reader only.

Manu Philip 18,706 Reputation points MVP

2025-01-15T06:58:21.35+00:00

Have you also checked the group's privileges that the user belongs to

Manu Philip 18,706 Reputation points MVP

2025-01-15T07:01:29.71+00:00

Also, check the roles assigned to the user and the roles that are assigned to the groups to which the user belongs using the following PowerShell cmd

Get-AzRoleAssignment -SignInName <email_or_userprincipalname> -ExpandPrincipalGroups

Handian Sudianto 5,666 Reputation points

2025-01-15T07:15:52.3+00:00

It's empty also

Manu Philip 18,706 Reputation points MVP

2025-01-15T07:36:45.2366667+00:00

Can you see the roles assigned to the user? Users> Select the user > Assigned Roles
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Andreas Baumgarten 115.9K Reputation points MVP

2025-01-15T07:38:55.4466667+00:00

Hi @Handian Sudianto ,

in addition to @Manu Philip.

You can check the assigned RBAC roles of an user in the Azure Portal including roles assigned by a group membership.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten
Please sign in to rate this answer.
Handian Sudianto 5,666 Reputation points

2025-01-15T07:47:08.9266667+00:00

hi @Andreas Baumgarten

Only network contributor and reader. Or network contributor role have access to the virtual machine such as restart, stop and create vm?

Andreas Baumgarten 115.9K Reputation points MVP

2025-01-15T08:24:24.8433333+00:00

Hi @Handian Sudianto ,

based on the official documentation of Microsoft the Network Contributor role is not allowed to restart, stop or create a VM: Network Contributor

Same for the Reader role (permission is only Read *): Reader

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure IAM Role

2 answers

Your answer