Which security principle does Azure Role-Based Access Control (RBAC) follow?
Show answer and explanation
Answer: B
RBAC is built around least privilege: each identity receives only the actions it genuinely needs, applied at the narrowest effective scope, chosen from the built-in role catalog or a custom definition. That containment is what limits the damage any single compromised account can do.
Blanket grants to everyone or to every administrator, and assignments driven purely by org chart instead of duties, all contradict least privilege and magnify blast radius.
Why the other options are wrong
- A. Handing full access to all users is the opposite of least privilege and turns any single compromised credential into a total compromise.
- C. Defaulting every administrator to unrestricted access across all subscriptions violates least privilege and makes lateral movement trivial once one admin account falls.
- D. Sizing permissions purely by department ignores what each user actually does, spreading far broader rights than their work requires.
Exam tip. RBAC = least privilege. Assign the most restrictive role at the narrowest scope that still lets the user work.