From 1e60571c78dffe127c7ceafbb9a9a0308f089b7a Mon Sep 17 00:00:00 2001 From: Quetzalli Date: Fri, 28 Aug 2026 16:26:30 +0200 Subject: [PATCH] DOC-299: Fill in remaining RBAC limitation gaps on role docs The opt-in RBAC enforcement section and most limitations were already documented on both pages. Add the gaps called out in the ticket: data-plane coverage is partial (Storage File, Service Bus, and Cosmos DB aren't covered; SQL/PostgreSQL/MySQL are out of scope since they use Entra database auth, not RBAC data actions), Key Vault keys are not yet enforced, and group role assignments aren't expanded to their members. Also note that management group scope is the only scope level without inheritance support. --- src/content/docs/azure/services/role-assignment.mdx | 5 ++++- src/content/docs/azure/services/role-definition.mdx | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/src/content/docs/azure/services/role-assignment.mdx b/src/content/docs/azure/services/role-assignment.mdx index 6f126fb26..6bce873ec 100644 --- a/src/content/docs/azure/services/role-assignment.mdx +++ b/src/content/docs/azure/services/role-assignment.mdx @@ -340,9 +340,12 @@ The default SDK/Terraform service principal and the `az` CLI's `any-app` princip ## Limitations - **RBAC enforcement is opt-in:** By default, role assignments are stored but not evaluated, and all operations succeed regardless of assigned roles. Set `LS_AZURE_ENFORCE_RBAC` to enable enforcement. +- **Data-plane coverage is partial:** Enforced for Storage (Blob/Queue/Table), Key Vault (secrets and certificates), and Event Grid. Not yet enforced for Storage File, the Service Bus data plane, or Cosmos DB. Azure SQL Database and Azure Database for PostgreSQL/MySQL flexible servers don't use RBAC data actions (their data-plane authorization is Microsoft Entra database authentication), so they're out of scope for RBAC. +- **Key Vault keys:** Only the secrets and certificates data planes are enforced; the keys data plane is not yet implemented. - **Condition-based assignments:** Attribute-based access control (ABAC) conditions in assignments are accepted at the model level but are not evaluated. - **Deny assignments:** `Microsoft.Authorization/denyAssignments` are not supported. -- **Management group scopes:** Assignments at management group scope are not supported. +- **Management group scopes:** Assignments at management group scope are not supported. Subscription, resource group, and resource scopes are supported, including inheritance down the hierarchy — a role assigned at a broader scope applies to narrower scopes beneath it. +- **Groups and transitive membership:** A role assigned to a group is not expanded to its members; only assignments made directly to the calling principal are evaluated. ## Samples diff --git a/src/content/docs/azure/services/role-definition.mdx b/src/content/docs/azure/services/role-definition.mdx index d7944158a..ef0ca34aa 100644 --- a/src/content/docs/azure/services/role-definition.mdx +++ b/src/content/docs/azure/services/role-definition.mdx @@ -167,6 +167,7 @@ az role definition list --name "Custom Storage Reader" ## Limitations - **RBAC enforcement is opt-in:** By default, role definitions and assignments are stored but permissions are not enforced, so API calls are not gated the way they are in Azure. Set `LS_AZURE_ENFORCE_RBAC` to enable enforcement; see [Role Assignment: Enabling RBAC enforcement](/azure/services/role-assignment/#enabling-rbac-enforcement) for scope and coverage. +- **Key Vault keys:** Role definitions can include `DataActions` permissions for Key Vault keys, but the keys data plane is not yet enforced — only secrets and certificates are. - **Management group scopes:** Management group–level assignable scopes are not supported. ## Samples