Status: IN
`NotActions` in Azure RBAC role definitions subtracts from the `Actions` set — it is not a deny rule; a separate role assignment granting excluded actions will still apply.
Source: entries/2026/03/11/rbac-custom-roles.md
JSON