هوية Microsoft Entra وAzure RBAC

{
  "model": "permission-planning-only",
  "cases": [
    {
      "role": "Reader",
      "operation": "management.read",
      "expected": "candidate-allow"
    },
    {
      "role": "Reader",
      "operation": "blob.read",
      "expected": "not-granted-by-this-role"
    },
    {
      "role": "Storage Blob Data Reader",
      "operation": "blob.read",
      "expected": "candidate-allow"
    }
  ]
}

management and data permissions are evaluated separately

ليست النتائج المرشحة تصريحاً حياً؛ فالنطاق والرفض والشروط والشبكة والاعتماد غير مختبرة.

def within(scope, target):
    return target == scope or target.startswith(scope + "/")
scope = "/subscriptions/s-lab/resourceGroups/rg-a"
print(within(scope, scope + "/providers/example/items/one"))
print(within(scope, "/subscriptions/s-lab/resourceGroups/rg-a2"))

True
False

يرفض الفحص المصطنع بادئة شقيقة ولا يفحص أذونات Azure الموروثة فعلياً.