Role-based access control
noun · also RBAC · NIST RBAC project
Granting permissions to roles, such as Help Desk or Billing Reader, and then assigning people to roles, instead of granting rights person by person.
With role-based access control (RBAC), permissions are bundled into roles that match job functions. A user receives access by being assigned a role, and loses it when the role is removed. When a role needs a new permission, it is added once and applies to everyone in that role.
RBAC is everywhere in the platforms a SOC monitors. Microsoft Entra ID has built-in roles such as Global Administrator, User Administrator and Security Reader; Azure RBAC controls who can manage each subscription and resource; Microsoft Sentinel and Defender XDR have their own roles for analysts. NIST's work in the 1990s and 2000s helped formalize the model that most of these systems follow.
Example
Instead of giving five help desk technicians individual rights to reset passwords, the organization assigns them the Helpdesk Administrator role. When a sixth technician joins, one role assignment gives them exactly the same access, and an access review only needs to check who holds the role.
Why it matters for a SOC analyst
Role assignments are high-value audit events. A new member of a privileged role, especially outside a change window or granted by an unusual account, can be an attacker escalating privileges or creating a backdoor. Know which roles are sensitive in your environment and make sure changes to them raise an alert.
Related terms
- Least privilege
Giving every user, service and application only the access it needs to do its job, and only for as long as it needs it.
- Identity and access management
The processes and tools that manage digital identities and decide what each one can access, from account creation to removal.
- Privilege escalation
Gaining higher permissions than an account was given, such as moving from a standard user to local administrator, domain admin or cloud global admin.