List in a role definition whose entries are removed from Actions, such as Microsoft.Authorization/* in the Contributor pattern. It is not a deny, so a different role can still grant those operations.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains NotActions in context, with comparison tables and the common traps.
Terms in this definition
- List
Permission on Key Vault secrets allowing a caller to enumerate those in a vault, though their values are not returned.
- Role definition
A set of permissions, for example read, write and delete, that is either built in (Owner, Contributor, Reader and others) or custom. People normally just call it a role.
- Contributor
Built-in Azure role with full management of resources, except that it can't give access to anyone.
- Pattern
A reusable answer to a recurring problem that places building blocks in context, explaining when, how and why to apply them and what compromises are involved.
- Deny
An Azure Policy effect that stops any create or update request that would break the policy.
- Role
How an actor normally or expectedly behaves, or the part a person takes in a process. A single actor may hold more than one role.
- Authorisation code
OAuth 2.0 grant used by native and web apps: the user signs in, and the app then acts on their behalf with delegated permissions.