RBAC or Entra role?
Know the boundary.

Two different control planes

Azure RBAC controls access to Azure resources through role assignments at resource scopes. Microsoft Entra roles govern directory and identity-management operations. They can work together, but they answer different authorization questions.

Azure Resource → Azure RBAC → Resource Access
Directory Object → Entra Role → Directory Operation

Azure RBAC

Use Azure RBAC when the question is whether an identity can perform an action against an Azure resource. Scope matters: management group, subscription, resource group and resource-level assignments can produce different effective access.

Entra roles

Use Microsoft Entra roles when the operation concerns directory identities, authentication configuration or other directory administration tasks. Do not assume a resource role automatically grants directory administration.

Troubleshooting access

First identify the exact operation and target. Then determine whether the failure belongs to the Azure resource plane or directory plane, inspect the applicable role assignment and scope, and verify the identity being used.

Operation → Target → Control Plane → Role → Scope → Effective Access

Security rule

Assign permissions at the narrowest useful scope and choose the role family that matches the control plane.