Static. The roles need to be redefined in the database for every change, every time.
Over privileges. The burden of maintaining (setting up and revoking) fine-grained permissions to each role is a pain and so overprivileges are granted as roles are extended.
Complicated Mapping. Mapping each role to groups in the AD is time-consuming and requires knowledge and a “future” understanding of what each group or user might need.
Not Scalable. As employees need more and more permissions, it’s nearly impossible to still deliver fine-grained access to members in AD groups. Instead more privileges are just being granted to the whole group.
Role Explosions. Roles in Azure are limited to defining access permissions by role, however, as each user often requires entirely unique access rights, one user may be assigned several roles, creating a ‘one size fits all’ solution that can result in too much (or too little) access. This also makes enterprises vulnerable to an exponential rise in roles versus users.