Updated 1 Nov 2026 · 7 min read
On this page
By the end of this page you will be able to tell, for any admin task, whether it needs an Azure role or a Microsoft Entra role, name the scopes each system uses, explain why a Global Administrator does not have access to Azure resources by default and how elevated access changes that, and describe how custom roles differ between the two systems. All of it is drawn from Microsoft Learn.
Two role systems protecting two different things
Microsoft's summary is short: Azure roles control permissions to manage Azure resources, while Microsoft Entra roles control permissions to manage Microsoft Entra resources. Azure resources are things such as virtual machines and storage. Microsoft Entra resources are resources in the directory such as users, groups, applications and domains.
The two systems are enforced in different places. Azure RBAC is an authorisation system built on Azure Resource Manager. Microsoft Entra roles control access through the Microsoft Graph API. Microsoft states that Microsoft Entra ID and Azure resources are secured independently: Microsoft Entra role assignments do not grant access to Azure resources, and Azure role assignments do not grant access to Microsoft Entra ID. Both systems use role definitions and role assignments, but Microsoft Entra role permissions cannot be used in Azure custom roles, and the reverse is also true.
This is the source of the confusion. Both are "role-based access control", both show up in the Azure portal, and both include roles with Administrator in the name, such as User Access Administrator in Azure RBAC and User Administrator in Microsoft Entra ID. The quickest test is to ask what is being changed. A virtual machine, storage account or resource group means Azure RBAC. A user, group, password, licence or domain means a Microsoft Entra role.
How an Azure role assignment works
An Azure role assignment has three parts. The security principal is the user, group, service principal or managed identity asking for access. The role definition is a collection of permissions, such as read, write and delete. The scope is the set of resources the access applies to.
Azure has four scope levels: management group, subscription, resource group and resource. They form a parent and child hierarchy, and you can assign roles at any level. Microsoft's example is a Marketing group given the Contributor role on the pharma-sales resource group. Its members can create or manage any Azure resource in that resource group, but have no access outside it unless another assignment grants it.
Azure RBAC is additive: your effective permissions are the sum of your role assignments. If you hold Contributor at the subscription scope and Reader on one resource group, you effectively have Contributor across the subscription, and the Reader assignment has no impact. The exception is a deny assignment. When Azure Resource Manager evaluates a request and a deny assignment applies, access is blocked, whatever roles you hold.
Microsoft Entra roles use the same three parts, but their scopes are different: the tenant (organisation-wide), an administrative unit, or an individual Microsoft Entra resource such as a group, an enterprise application or an application registration.
The built-in roles side by side
Azure RBAC has over 100 built-in roles. Microsoft describes five of them as fundamental, and picks out a few of the more important Microsoft Entra roles.
| Role | System | What it allows |
|---|---|---|
| Owner | Azure RBAC | Full access to manage all resources, including assigning roles in Azure RBAC |
| Contributor | Azure RBAC | Full access to manage all resources, but cannot assign roles in Azure RBAC |
| Reader | Azure RBAC | View Azure resources only |
| User Access Administrator | Azure RBAC | Manage user access to Azure resources and assign roles, including Owner |
| Role Based Access Control Administrator | Azure RBAC | Manage user access to Azure resources and assign roles, including Owner, but cannot manage access in other ways, such as Azure Policy |
| Global Administrator | Microsoft Entra | All administrative features in Microsoft Entra ID and services that federate to it, assign administrator roles, reset any password |
| User Administrator | Microsoft Entra | Create and manage all aspects of users and groups, change passwords for users, Helpdesk administrators and other User Administrators |
Two details are worth memorising. The person who signs up for the Microsoft Entra tenant becomes a Global Administrator. And even though a Global Administrator can manage access to all administrative features in Microsoft Entra ID, Microsoft says the role does not, by default, have access to Azure resources.
Microsoft's own comparison of the two systems:
| Azure roles | Microsoft Entra roles |
|---|---|
| Manage access to Azure resources | Manage access to Microsoft Entra resources |
| Support custom roles | Support custom roles |
| Scope: management group, subscription, resource group, resource | Scope: tenant, administrative unit, or an individual object such as one application |
| Role information accessed in the Azure portal, Azure CLI, Azure PowerShell, Azure Resource Manager templates, REST API | Role information accessed in the Azure portal, Microsoft Entra admin center, Microsoft 365 admin center, Microsoft Graph, Microsoft Graph PowerShell |
Where the systems meet: elevated access
By default, Azure roles and Microsoft Entra roles do not span the two systems, and Microsoft documents elevated access as the exception. In the Azure portal, a Global Administrator can elevate their access by going to Microsoft Entra ID, then Manage, then Properties, and setting Access management for Azure resources to Yes. They are then assigned the User Access Administrator role (an Azure role) at root scope (/), which lets them view all resources and assign access in any subscription or management group in the tenant.
Microsoft lists the reasons to do this: regaining access to a subscription or management group when a user has lost access, granting access to another user or yourself, seeing all subscriptions or management groups, and letting an automation app reach all of them. The toggle is only available to users assigned the Global Administrator role, and it applies only to the signed-in user, not to every Global Administrator. Microsoft says you should remove the elevated access once you have made your changes, by setting the toggle back to No or by using Azure PowerShell, Azure CLI or the REST API.
Custom roles in each system
Azure custom roles are for when the built-in roles do not fit. Like built-in roles, you can assign them to users, groups and service principals at management group, subscription and resource group scopes. They can be shared between subscriptions that trust the same Microsoft Entra tenant, with a limit of 5,000 custom roles per tenant (2,000 in Microsoft Azure operated by 21Vianet). A custom role that includes DataActions cannot be assigned at management group scope. You typically start from an existing built-in role and adjust its Actions, NotActions, DataActions and NotDataActions.
Microsoft Entra custom roles are built from a preset list of permissions, the same permissions the built-in roles use, and then assigned through a role assignment. The most common scope is organisation-wide, and a custom role can also be assigned at an object scope such as a single application. Built-in Microsoft Entra roles cannot be modified. Using custom roles requires a Microsoft Entra ID P1 licence for every user with a custom role assignment.
How this fits your exam
Microsoft AZ-104 (skills measured as of April 17, 2026). Under "Manage Azure identities and governance (20 to 25%)", the "Manage access to Azure resources" group lists "Manage built-in Azure roles", "Assign roles at different scopes" and "Interpret access assignments". Our AZ-104 study guide covers the rest.
Microsoft SC-300 (skills measured as of April 27, 2026). Under "Implement and manage user identities (20 to 25%)", the study guide lists "Configure and manage built-in and custom Microsoft Entra roles" and "Evaluate effective permissions for Microsoft Entra roles". Under "Plan and implement privileged access", part of "Plan and automate identity governance (20 to 25%)", it lists planning and managing both Microsoft Entra roles and Azure resources in Privileged Identity Management (PIM). See the SC-300 study guide.
Microsoft AZ-900 (skills measured as of July 20, 2026). Under "Describe Azure architecture and services (35 to 40%)", the "Describe Azure identity, access, and security" group lists "Describe Azure role-based access control (RBAC)". The AZ-900 study guide has the full outline.
Frequently asked questions
Does a Global Administrator automatically have access to my Azure subscriptions?
No. Microsoft states that by default the Global Administrator does not have access to Azure resources. They can gain it by elevating access, which assigns User Access Administrator at root scope, or by being given an Azure role assignment.
What happened to Account Administrator, Service Administrator and Co-Administrator?
They are the three classic subscription administrator roles. Microsoft says the classic administrator roles were retired as of August 31, 2024. Starting in December 2025, Azure automatically assigned the Owner role at subscription scope to users still holding Co-Administrator or Service Administrator in the public cloud, and as of May 2026 the classic administrator roles are fully retired, so you must assign roles in Azure RBAC to manage access. Account Administrator is the exception: Microsoft describes it as the primary user for your billing account and says it is not being deprecated.
Can I put Microsoft Entra permissions into an Azure custom role?
No. Microsoft states that Microsoft Entra role permissions cannot be used in Azure custom roles, and Azure permissions cannot be used in Microsoft Entra custom roles.
Sources
- Azure roles, Microsoft Entra roles, and classic subscription administrator roles
- What is Azure role-based access control (Azure RBAC)?
- Elevate access to manage all Azure subscriptions and management groups
- Overview of Microsoft Entra role-based access control (RBAC)
- Azure custom roles
Try the free AZ-104 practice questions on role assignments, then continue with the AZ-104 study guide.