Azure roles control access to Azure resources such as virtual machines and storage. Microsoft Entra roles control access to directory objects such as users, groups and domains. They are separate systems with separate assignments, and by default one does not grant anything in the other.
Two systems, two jobs
Microsoft's documentation draws the line at what each manages.
Azure RBAC is the authorization system built on Azure Resource Manager. It has over 100 built-in roles and supports custom ones. Five fundamental roles exist: Owner, Contributor, Reader, Role Based Access Control Administrator and User Access Administrator. Assignments can be made at management group, subscription, resource group or resource scope.
Microsoft Entra roles manage directory resources: creating users, resetting passwords, managing licenses and domains. Examples include Global Administrator, User Administrator and Billing Administrator. They can be scoped to the whole tenant, an administrative unit or a single object.
The difference in one table
- Manage: Azure roles: Azure resources; Entra roles: Entra resources
- Scope: Azure roles: Management group, subscription, resource group, resource; Entra roles: Tenant, administrative unit, individual object
- Custom roles: Azure roles: Yes; Entra roles: Yes
- Where to view: Azure roles: Access control (IAM) pages; Entra roles: Roles and administrators page
Owner versus Contributor
Owner has full access to manage resources and can also assign roles. Contributor has full resource management but cannot assign roles. That one difference decides who can grant access to others, so assign Owner sparingly.
User Access Administrator and Role Based Access Control Administrator can assign roles, including giving themselves Owner. Treat them as highly privileged too, even though they do not name resources.
Where they overlap
By default, Azure roles and Entra roles do not span each other. A Global Administrator, for example, does not automatically have access to Azure resources.
There is one deliberate bridge. A Global Administrator can turn on the Access management for Azure resources switch. That grants the User Access Administrator role on all subscriptions in the tenant, which is useful to regain access to a subscription. It is also the reason Global Administrator accounts need strong protection: they can reach resources too, by elevating.
Some Entra roles also span Entra ID and Microsoft 365, such as Global Administrator and User Administrator.
Practical guidance
- Keep a short list of who holds Global Administrator and treat each as a sensitive account.
- Assign Azure roles at the narrowest scope that works, such as a resource group instead of a subscription.
- Use specific built-in roles such as Virtual Machine Contributor rather than Contributor where you can.
- Review both role systems in access reviews. A review that covers only one leaves a gap.
- Alert on use of the elevate access switch.
A note on classic roles
Microsoft states that classic subscription administrator roles are fully retired as of May 2026, and that users who still held them were given the Owner role at subscription scope automatically. Check who ended up with Owner as a result.
Quick check
Can a Global Administrator manage my VMs?
Not by default. They can elevate access to gain the User Access Administrator role across subscriptions, then assign themselves what they need.
Which role should most engineers have?
Usually a narrow built-in role at resource group scope, not Owner at subscription scope.
Sources
Last reviewed: 19 October 2026.
