# Do not treat Azure role exclusions as explicit denials

> Review other role grants before relying on NotActions or NotDataActions to prevent an operation.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:28:17+00:00
- Modified: 2026-09-10T01:20:46+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Review other role grants before relying on NotActions or NotDataActions to prevent an operation.

## Potentially affected

Azure RBAC role reviews involving NotActions or NotDataActions exclusions.

## DSE recommendation

Evaluate the principal's applicable grants together; do not present a role subtraction as a deny assignment.

## Article

## Source facts

NotActions removes operations from a role’s allowed control-plane actions; it does not create a denial. Microsoft explicitly says that another assigned role can grant an operation excluded by the first role.

The same principle applies to NotDataActions on the data plane. Microsoft distinguishes these subtractions from deny assignments, which can block an action despite a role grant. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions).

## Applicability

Start with a specific principal, operation and resource scope. Identify whether the question concerns the control plane or data plane and collect the applicable assignments before interpreting a custom role’s exclusion list.

## DSE recommendation

DSE recommends explaining an exclusion as a limit on that role’s grant, not a prohibition applying everywhere. During a least-privilege review, identify other roles that grant the disputed operation and assign an owner to resolve unintended access. Do not prescribe a deny mechanism without separately reviewing its supported deployment and administration model.

## Verification

In an authorized test scope, compare the intended operation under the restricted role alone and under the actual combined assignments. Record which role supplies any remaining grant. Test a disallowed operation as well as a required one, and preserve scope and principal identifiers with the result so the conclusion is not mistaken for a tenant-wide access guarantee.

## Official references

[Microsoft Learn: Understand Azure role definitions – Azure RBAC](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions). Source retrieved September 9, 2026.

## Primary reference

- Name: Understand Azure role definitions - Azure RBAC | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Do not treat Azure role exclusions as explicit denials,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-219-do-not-treat-azure-role-exclusions-as-explicit-denials/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.