Having trouble understanding Azure's Roles JSON

Question

Its just a concept im having trouble understanding with the wildcard * and what that means, so here we have two roles Owner and contributor.

"Name": "Contributor",
  "Id": "b24988ac-6180-42a0-ab88-20f7382dd24c",
"IsCustom": false,
"Description": "Lets you manage everything except access to resources.",
"Actions": ["*"],
"NotActions": [
 "Microsoft.Authorization/*/Delete",
"Microsoft.Authorization/*/Write",
"Microsoft.Authorization/elevateAccess/Action'],
  "DataActions": [],
  "NotDataActions": [],
"AssignableScopes": [],
"/"
Name             : Owner
Id               : 8e3af657-a8ff-443c-a75c-2fe8c4bcb635
IsCustom         : False
Description      : Grants full access to manage all resources, including the ability to assign roles in Azure RBAC.
Actions          : {*}
NotActions       : {}
DataActions      : {}
NotDataActions   : {}
AssignableScopes : {/}

So my hang up is use of the astrisk, i know * under Owner means everything but with contributor, why is it used under the NotActions permissions? Why is it "Microsoft.Authorization/*/Delete" instead of Microsoft.Authorization/Delete". The permission in question stops the contributor from deleting users. So i know how these roles and permissions work, im just really struggling with the syntax. I have read the documentation on microsoft learn but there is something i clearly dont understand about the *. Does anyone with any knowledge know of a way of explaining this to help clear it up or maybe someone could point me to some better documentation? Any help would be greatly appreciated.

Answer 1

Why is it "Microsoft.Authorization/*/Delete" instead of Microsoft.Authorization/Delete".

To understand this, please see this link especially Operations format section.

Essentially each operation is specified in {Company}.{ProviderName}/{resourceType}/{action} format.

So when you specify the operation as Microsoft.Authorization/*/Delete, you're essentially allowing delete operation on all the resources under Microsoft.Authorization resource provider.

This format also enables you to specify actions granularly at each resource level under a resource provider.