Provides fine-grained access management of resources in Azure
Built on Azure Resource Manager
Segregate duties within your team
Grant only the amount of access to users that they need to perform their jobs
Concepts
Security principal. Object that represents something that is requesting access to resources
Role definition. Collection of permissions that lists the operations that can be performed
Scope. Boundary for the level of access that is requested
Assignment. Attaching a role definition to a security principal at a particular scope
Users can grant access described in a role definition by creating an assignment
Deny assignments are currently read-only and can only be set by Azure