Azure RBAC: built-in roles (Owner, Contributor, Reader, User Access Administrator), assigning roles at different scopes and interpreting access

Azure role-based access control (RBAC) decides what a signed-in identity can do to Azure resources. Every grant is a role assignment made of three parts: a security principal (a user, group, service principal or managed identity), a role definition (a list of allowed operations) and a scope (where the grant applies). If you remember 'who, what, where', you can read any assignment and predict what it allows. RBAC is the answer whenever a question asks who may create, change, view or delete resources.