Examkin

Question

Difficulty: MediumAzure Role Assignments and Scopes

An enterprise administrator configures the following Azure environment hierarchy for a logistics project:

* Management Group: `Logistics-MG`
* Subscription: `Logistics-Prod-Sub`
* Resource Group: `RG-Logistics-Data`
* Storage Account: `salogisticsimages`

User Admin1 is assigned the following roles:
* Microsoft Entra ID role: Global Administrator
* Azure RBAC role: Reader assigned at the `Logistics-MG` scope

Admin1 needs to assign the Contributor role to a developer at the resource group `RG-Logistics-Data` level.

Which role assignment represents the minimum privilege required to enable Admin1 to perform this task?

  1. User Access Administrator assigned to Admin1 at the RG-Logistics-Data scopeAnswer
  2. B
    Owner assigned to Admin1 at the Logistics-Prod-Sub scope
  3. C
    User Access Administrator assigned to Admin1 at an Administrative Unit scope containing the resource group
  4. D
    Global Administrator role elevated to manage all Azure subscriptions in the tenant

Answer

User Access Administrator assigned to Admin1 at the RG-Logistics-Data scope
The correct answer is User Access Administrator assigned to Admin1 at the RG-Logistics-Data scope. Azure Role-Based Access Control (RBAC) requires the 'Microsoft.Authorization/roleAssignments/write' action to delegate access, which is provided by the User Access Administrator role. To adhere to the principle of least privilege, this role should be assigned at the narrowest scope possible, which is the resource group where the developer needs permissions.

Step-by-Step Solution

1
Identify the permission needed to perform role assignments in Azure.
Assigning roles requires the Microsoft.Authorization/roleAssignments/write action, which is included in the User Access Administrator and Owner roles.
This determines which roles are capable of assigning permissions.
2
Determine the appropriate scope for the assignment based on the principle of least privilege.
The target scope where the role needs to be assigned is the resource group named RG-Logistics-Data.
Applying the role at the target resource group level ensures the administrator has permissions only where needed, avoiding inheritance from a higher scope like the subscription or management group.
3
Evaluate the existing Microsoft Entra ID Global Administrator role configuration.
Although a Global Administrator can elevate access to obtain the User Access Administrator role at the root scope, doing so is not the least privileged option for a task limited to a single resource group.
This rules out tenant-wide elevation when a localized resource assignment is sufficient.

Key Concept

Azure RBAC delegation requires the User Access Administrator or Owner role assigned at the most restrictive scope containing the resource where permissions must be modified.
Estimated Time:1m 30s
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic