1

If an Azure user has Contributor rights to a Subscription and they create a resource under that subscription e.g. a Storage Account. Should that user be automatically granted owner rights over the resource? They would then be able to manage who has what permissions to it. I.e. add/remove role assignments in Access Control (IAM).

I've noticed in my enterprise's tenant that contributors cannot modify permissions on resources they create. But I can't quite determine whether this is the default behavior in Azure, or whether it's policy we've put in place.

Azure Portal

From my queries to Chat GPT and Bing Chat, they believe that the creator of the resource receive owner rights, but they were unable to cite a reference for it.

Venkat V
  • 2,197
  • 1
  • 1
  • 10
Caleb Seadon
  • 684
  • 8
  • 18

1 Answers1

3

If an Azure user has Contributor rights to a Subscription and they create a resource under that subscription e.g. a Storage Account.Should that user be automatically granted owner rights over theresource?

If you have a contributor role at the subscription level, you can grant full access to manage all resources within your subscription. However, you are unable to assign RBAC roles such as Owner, Contributor, and Reader to your resources. This behavior is the default in Azure.

By default, contributors can create and manage all types of Azure resources, but they cannot grant access to others. They can only grant access to resources they create if they have been granted the Owner role on the resource.

I have a contributor role on the subscription and created a Virtual Machine Scale Set, but I am unable to assign RBAC roles to the VMSS

enter image description here

Refer the Microsoft Document more about Azure role-based access control (RBAC)
Understand role assignments

Venkat V
  • 2,197
  • 1
  • 1
  • 10