Is a user with "Contributor" and "User Access Administrator" roles same as a user with "Owner" role?

Question

So we have got 3 built-in roles: Owner, Contributor and User Access Administrator.

Considering a Contributor can do everything in an Azure Subscription except RBAC role assignment and a User Access Administrator can do RBAC role assignment, can we assume that if a user is assigned both Contributor and User Access Administrator roles at a particular scope (e.g. Subscription), they are effectively an Owner for that scope?

Or are there certain things that still only an Owner can do?

score 4 · Accepted Answer · answered Aug 01 '22 at 20:59

If we look at the permissions:

A Owner can do anything: "actions": ["*"].
A User Admin can only read anything (except secret), manage roles and create and update support tickets: "actions": ["*/read", "Microsoft.Authorization/*", "Microsoft.Support/*"]

A contributor can do anything except managing roles, managing blueprint assignment and sharing a gallery to different scopes

"actions": [
  "*"
],
"notActions": [
  "Microsoft.Authorization/*/Delete",
  "Microsoft.Authorization/*/Write",
  "Microsoft.Authorization/elevateAccess/Action",
  "Microsoft.Blueprint/blueprintAssignments/write",
  "Microsoft.Blueprint/blueprintAssignments/delete",
  "Microsoft.Compute/galleries/share/action"
],

So a user with Contributor and User Access Administrator roles is missing some permissions compared to the Owner Role: Can't create/delete blueprint and can't share gallery to different scopes

Is a user with "Contributor" and "User Access Administrator" roles same as a user with "Owner" role?

1 Answers1