{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials/", "slug": "dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials", "url": "https://update.dsesecurity.com/updates/dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials/" }, "title": "Do not treat Azure role exclusions as explicit denials", "summary": "Review other role grants before relying on NotActions or NotDataActions to prevent an operation.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:17+00:00", "modified_at": "2026-09-10T01:20:46+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 1, "word_count": 220, "potentially_affected": "Azure RBAC role reviews involving NotActions or NotDataActions exclusions.", "dse_recommendation": "Evaluate the principal's applicable grants together; do not present a role subtraction as a deny assignment.", "primary_source": { "name": "Understand Azure role definitions - Azure RBAC | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

NotActions removes operations from a role’s allowed control-plane actions; it does not create a denial. Microsoft explicitly says that another assigned role can grant an operation excluded by the first role.

\n

The same principle applies to NotDataActions on the data plane. Microsoft distinguishes these subtractions from deny assignments, which can block an action despite a role grant. Microsoft Learn.

\n

Applicability

\n

Start with a specific principal, operation and resource scope. Identify whether the question concerns the control plane or data plane and collect the applicable assignments before interpreting a custom role’s exclusion list.

\n

DSE recommendation

\n

DSE recommends explaining an exclusion as a limit on that role’s grant, not a prohibition applying everywhere. During a least-privilege review, identify other roles that grant the disputed operation and assign an owner to resolve unintended access. Do not prescribe a deny mechanism without separately reviewing its supported deployment and administration model.

\n

Verification

\n

In an authorized test scope, compare the intended operation under the restricted role alone and under the actual combined assignments. Record which role supplies any remaining grant. Test a disallowed operation as well as a required one, and preserve scope and principal identifiers with the result so the conclusion is not mistaken for a tenant-wide access guarantee.

\n

Official references

\n

Microsoft Learn: Understand Azure role definitions – Azure RBAC. Source retrieved September 9, 2026.

", "content_text": "Source facts\nNotActions removes operations from a role’s allowed control-plane actions; it does not create a denial. Microsoft explicitly says that another assigned role can grant an operation excluded by the first role.\nThe same principle applies to NotDataActions on the data plane. Microsoft distinguishes these subtractions from deny assignments, which can block an action despite a role grant. Microsoft Learn.\nApplicability\nStart with a specific principal, operation and resource scope. Identify whether the question concerns the control plane or data plane and collect the applicable assignments before interpreting a custom role’s exclusion list.\nDSE recommendation\nDSE recommends explaining an exclusion as a limit on that role’s grant, not a prohibition applying everywhere. During a least-privilege review, identify other roles that grant the disputed operation and assign an owner to resolve unintended access. Do not prescribe a deny mechanism without separately reviewing its supported deployment and administration model.\nVerification\nIn an authorized test scope, compare the intended operation under the restricted role alone and under the actual combined assignments. Record which role supplies any remaining grant. Test a disallowed operation as well as a required one, and preserve scope and principal identifiers with the result so the conclusion is not mistaken for a tenant-wide access guarantee.\nOfficial references\nMicrosoft Learn: Understand Azure role definitions – Azure RBAC. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nNotActions removes operations from a role’s allowed control-plane actions; it does not create a denial. Microsoft explicitly says that another assigned role can grant an operation excluded by the first role.\n\nThe same principle applies to NotDataActions on the data plane. Microsoft distinguishes these subtractions from deny assignments, which can block an action despite a role grant. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions).\n\n## Applicability\n\nStart with a specific principal, operation and resource scope. Identify whether the question concerns the control plane or data plane and collect the applicable assignments before interpreting a custom role’s exclusion list.\n\n## DSE recommendation\n\nDSE recommends explaining an exclusion as a limit on that role’s grant, not a prohibition applying everywhere. During a least-privilege review, identify other roles that grant the disputed operation and assign an owner to resolve unintended access. Do not prescribe a deny mechanism without separately reviewing its supported deployment and administration model.\n\n## Verification\n\nIn an authorized test scope, compare the intended operation under the restricted role alone and under the actual combined assignments. Record which role supplies any remaining grant. Test a disallowed operation as well as a required one, and preserve scope and principal identifiers with the result so the conclusion is not mistaken for a tenant-wide access guarantee.\n\n## Official references\n\n[Microsoft Learn: Understand Azure role definitions – Azure RBAC](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials/", "url": "https://update.dsesecurity.com/updates/dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not treat Azure role exclusions as explicit denials", "item": "https://update.dsesecurity.com/updates/dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials/", "url": "https://update.dsesecurity.com/updates/dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials/", "headline": "Do not treat Azure role exclusions as explicit denials", "description": "Review other role grants before relying on NotActions or NotDataActions to prevent an operation.", "abstract": "Review other role grants before relying on NotActions or NotDataActions to prevent an operation.", "articleBody": "Source facts\nNotActions removes operations from a role’s allowed control-plane actions; it does not create a denial. Microsoft explicitly says that another assigned role can grant an operation excluded by the first role.\nThe same principle applies to NotDataActions on the data plane. Microsoft distinguishes these subtractions from deny assignments, which can block an action despite a role grant. Microsoft Learn.\nApplicability\nStart with a specific principal, operation and resource scope. Identify whether the question concerns the control plane or data plane and collect the applicable assignments before interpreting a custom role’s exclusion list.\nDSE recommendation\nDSE recommends explaining an exclusion as a limit on that role’s grant, not a prohibition applying everywhere. During a least-privilege review, identify other roles that grant the disputed operation and assign an owner to resolve unintended access. Do not prescribe a deny mechanism without separately reviewing its supported deployment and administration model.\nVerification\nIn an authorized test scope, compare the intended operation under the restricted role alone and under the actual combined assignments. Record which role supplies any remaining grant. Test a disallowed operation as well as a required one, and preserve scope and principal identifiers with the result so the conclusion is not mistaken for a tenant-wide access guarantee.\nOfficial references\nMicrosoft Learn: Understand Azure role definitions – Azure RBAC. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:28:17+00:00", "dateModified": "2026-09-10T01:20:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not treat Azure role exclusions as explicit denials" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 220, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Understand Azure role definitions - Azure RBAC | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions" } } ] } }