Examkin

Question

Difficulty: MediumAzure Role Assignments and Scopes

A Microsoft Entra tenant contains the following resource hierarchy:
* Root Management Group
* Subscription: `sub-shared-infra`
* Resource Group: `rg-network-hub`
* Virtual Network: `vnet-core`

A user named Admin1 is assigned only the Global Administrator directory role in Microsoft Entra ID. Admin1 needs to assign the Network Contributor role to a group named NetOps at the `rg-network-hub` scope. Currently, Admin1 cannot view `sub-shared-infra` or `rg-network-hub` in the Azure portal.

Which action should Admin1 take to assign the role?

  1. A
    Assign the Global Administrator role to the Root Management Group to force the directory role permissions to inherit down to the resource group.
  2. Elevate access in the Microsoft Entra admin center to obtain the User Access Administrator role at the root scope, and then perform the role assignment at the resource group scope.Answer
  3. C
    Create an Administrative Unit that includes the virtual network, and assign the User Access Administrator role to Admin1 at the Administrative Unit scope.
  4. D
    Assign Admin1 the Reader role on the virtual network, which automatically inherits upward to grant user administration permissions on the parent resource group.

Answer

Elevate access in the Microsoft Entra admin center to obtain the User Access Administrator role at the root scope, and then perform the role assignment at the resource group scope.
Elevating access in the Microsoft Entra admin center assigns the User Access Administrator role to the Global Administrator at the root scope. This permits the administrator to view all subscriptions and configure role assignments at any level of the Azure resource hierarchy.

Step-by-Step Solution

1
Elevate directory privileges for the Global Administrator in the Microsoft Entra admin center.
Admin1 is assigned the User Access Administrator role at the root scope (/).
By default, Microsoft Entra ID directory roles like Global Administrator do not have permissions to manage Azure subscriptions or resource groups.
2
Access the subscription and resource group scopes in the Azure portal or CLI.
Admin1 can now view the `sub-shared-infra` subscription and `rg-network-hub` resource group.
The User Access Administrator role at the root scope inherits down the entire hierarchy, granting the ability to view resources and manage access.
3
Assign the Network Contributor role to the NetOps group at the resource group scope.
The Network Contributor role is successfully assigned to the group for the target scope.
The User Access Administrator role provides the authorization required to write role assignments at the resource group level.

Key Concept

Azure RBAC Scope and Root Access Elevation for Global Administrators
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic