Explanation: Role3 is an Azure subscription role and you are able to clone Azure subscription roles and custom roles. https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles-portal Role4 is an Azure AD role and it just are able to clone customer roles. https://learn.microsoft.com/en-us/azure/active-directory/roles/custom-create