Your organization has an Azure active directory tenant integrated with an Azure resource h… — Microsoft Azure Administrator (AZ-104)

Your organization has an Azure active directory tenant integrated with an Azure resource hierarchy structured as follows:
- Production-MG (Management Group)
- Subscription-A (Subscription)
- RG-Secure (Resource Group)
- sa-audit (Storage Account)
- RG-Compute (Resource Group)

You must configure access for a security group named Audit-Admins to meet the following requirements:
1. Members must be able to assign Azure RBAC roles to other users only within the scope of RG-Secure.
2. Members must be able to view and download audit logs stored in the blob service of sa-audit. They must not be able to modify firewall settings, delete the storage account, or view access keys.
3. Members must be able to add and remove members from Microsoft Entra ID security groups used for auditing.

You must follow the principle of least privilege and minimize administrative overhead.

Which combination of role assignments should you configure?

A
In Azure RBAC: Assign the User Access Administrator and Storage Account Contributor roles to Audit-Admins at the RG-Secure scope. In Microsoft Entra ID: Assign the Groups Administrator role to Audit-Admins.
In Azure RBAC: Assign the User Access Administrator role to Audit-Admins at the RG-Secure scope, and assign the Storage Blob Data Reader role to Audit-Admins at the sa-audit scope. In Microsoft Entra ID: Assign the Groups Administrator role to Audit-Admins.Answer
C
In Azure RBAC: Assign the Groups Administrator role to Audit-Admins at the RG-Secure scope, and assign the Storage Blob Data Reader role to Audit-Admins at the sa-audit scope. In Microsoft Entra ID: Assign the User Access Administrator role to Audit-Admins.
D
In Azure RBAC: Assign the User Access Administrator and Storage Blob Data Reader roles to Audit-Admins at the Subscription-A scope, and configure a Deny assignment for Audit-Admins on the RG-Compute scope. In Microsoft Entra ID: Assign the Groups Administrator role to Audit-Admins.

Answer

In Azure RBAC: Assign the User Access Administrator role to Audit-Admins at the RG-Secure scope, and assign the Storage Blob Data Reader role to Audit-Admins at the sa-audit scope. In Microsoft Entra ID: Assign the Groups Administrator role to Audit-Admins.

To satisfy the requirements with the least privilege, you must assign the User Access Administrator role at the RG-Secure scope, which restricts role assignment capabilities to that resource group. Data-plane blob access is granted via the Storage Blob Data Reader role at the specific sa-audit resource scope, which prevents the group from performing control-plane actions like modifying firewall configurations, deleting the storage account, or listing access keys. Finally, since group membership management is a Microsoft Entra ID directory task rather than an Azure resource task, the Groups Administrator directory role must be assigned.

Step-by-Step Solution

Determine the role and scope required for managing Azure RBAC assignments.

User Access Administrator role at the RG-Secure resource group scope.

This role allows the group to assign RBAC roles to others, and scoping it to RG-Secure ensures they cannot assign roles outside this resource group.

Determine the least-privileged role and scope required for viewing and downloading blobs from the storage account.

Storage Blob Data Reader role at the sa-audit storage account scope.

The Storage Blob Data Reader role provides data-plane access to read blobs. Assigning it directly to sa-audit prevents access to other storage accounts. Standard control-plane roles like Contributor or Storage Account Contributor are rejected because they allow modifying firewall configurations and regenerating access keys.

Determine the directory role required for managing Entra ID security group memberships.

Groups Administrator role at the Microsoft Entra ID tenant level.

Azure RBAC roles do not manage Entra ID directory objects like groups. The Groups Administrator role is the least-privileged directory role that can manage group memberships.

Key Concept

Azure RBAC role assignments must follow the principle of least privilege, separating control-plane from data-plane access, and distinguishing between Azure resource roles and Microsoft Entra ID directory roles.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic