Examkin

Question

Difficulty: HardAzure Role Assignments and Scopes

An organization uses an Azure tenant hierarchy configured as follows:
- Tenant Root Group (Management Group)
- MG-Prod (Management Group)
- Sub-Prod-01 (Subscription)
- RG-Sec (Resource Group)
- RG-App (Resource Group)
- VM-App-01 (Virtual Machine)

You have two users with the following role configurations:
- User1 is assigned the Global Administrator directory role in Microsoft Entra ID. No other roles are assigned.
- User2 is assigned the User Access Administrator role at the MG-Prod management group scope.

User1 needs to assign the Contributor role to a security group at the RG-App scope.
User2 needs to assign the Reader role to a service principal at the RG-Sec scope.

Who can perform their respective role assignments without modifying any existing permissions or configurations?

  1. Only User2Answer
  2. B
    Only User1
  3. C
    Both User1 and User2
  4. D
    Neither User1 nor User2

Answer

Only User2 can perform the role assignment without modifying existing permissions.
The correct option is that only User2 can perform the role assignment. User2 has the User Access Administrator role at the MG-Prod scope, which grants them the ability to write role assignments. Because of Azure RBAC inheritance, this permission flows down to all child scopes including the Sub-Prod-01 subscription and the RG-Sec resource group. User1, despite being a Microsoft Entra ID Global Administrator, cannot perform resource-level role assignments by default. Global Administrators must first elevate their access in the Azure portal, which explicitly assigns them the User Access Administrator role at the Tenant Root Group level before they can manage Azure subscription permissions.

Step-by-Step Solution

1
Analyze the Microsoft Entra ID role assignment for User1.
User1 has the Global Administrator directory role.
Microsoft Entra ID roles are structurally separate from Azure RBAC roles. A Global Administrator has no default permissions to manage Azure resources (subscriptions, resource groups, etc.) until they explicitly elevate their access in the Entra ID settings.
2
Analyze the Azure RBAC role assignment and scope for User2.
User2 has the User Access Administrator role at the MG-Prod management group scope.
The User Access Administrator role contains the `Microsoft.Authorization/roleAssignments/write` data action, which allows the user to configure role assignments at their assigned scope.
3
Apply the principles of RBAC scope inheritance down the hierarchy.
User2's permissions at MG-Prod inherit down through Sub-Prod-01 to RG-Sec.
Azure RBAC assignments are inherited from parent scopes (Management Groups) to child scopes (Subscriptions and Resource Groups). Since RG-Sec is a child of Sub-Prod-01, which is a child of MG-Prod, User2 has effective User Access Administrator rights at the RG-Sec level.

Key Concept

Azure RBAC roles inherit down the resource hierarchy (Management Group -> Subscription -> Resource Group -> Resource), whereas Microsoft Entra ID directory roles do not automatically grant permissions on Azure resources without explicit access elevation.
Estimated Time:2m 0s
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic