RBAC (Role-Based Access Control) — Definition & Context in B2B Laptop Rental

An access-control model where permissions are granted based on a user's role within the organization, not per individual. Example: the "finance staff" role has access to the ERP AP/AR module but not to payroll; the "IT admin" role has access to CMDB and MDM console but not financial data. In the Microsoft ecosystem, RBAC is managed through Azure AD (Entra ID) with built-in and custom roles assignable to users, groups, or service principals. Contrast with ACL (Access Control List), which defines permissions per resource per individual — RBAC is more scalable for organizations with more than 50 users. Relevance to laptop rental: when a new unit is onboarded via MDM, the RBAC policies already configured in Azure AD automatically apply to that device without manual per-unit configuration. Quarterly RBAC access review is a required control under ISO 27001 Annex A 5.18.