What does deny assignment in Azure RBAC do?
- A Removes an existing role assignment
- B Explicitly blocks specified actions even if a role assignment would allow them (e.g., applied by Azure Blueprints) (correct answer)
- C Prevents deletion of resources
- D Revokes all access
Shortcut: Deny assignments take precedence over role assignments. They block specific actions on resources regardless of what roles a user has. Azure Blueprints use deny assignments to enforce protected configurations.