Examkin

Question

Difficulty: EasyAzure Role Assignments and Scopes

An administrator manages an Azure tenant with the following resource hierarchy:
* Management Group: `MG-Corp`
* Subscription: `Sub-Dev`
* Resource Group: `RG-App`

A user named User1 needs to view all resources within `RG-App`.

Which two role assignments will allow User1 to view the resources? (Select two.)

  1. Assign the Reader role to User1 at the `RG-App` scope.Answer
  2. Assign the Reader role to User1 at the `Sub-Dev` scope.Answer
  3. C
    Assign the Global Reader role to User1 in Microsoft Entra ID.
  4. D
    Assign the Reader role to User1 at an Administrative Unit scope containing the resource group.

Answer

Assigning the Reader role to User1 at the resource group scope, or assigning the Reader role to User1 at the subscription scope.
Assigning the Reader role at either the resource group scope (direct assignment) or the subscription scope (inherited assignment) successfully grants read access to all resources within the resource group. Azure RBAC assignments inherit down the resource hierarchy: from subscription to resource group to child resources.

Step-by-Step Solution

1
Evaluate the required permission and target scope.
The user needs to view all resources in the resource group `RG-App`.
This establishes the target resource and required access level (read access).
2
Analyze direct and inherited RBAC assignments.
An assignment at the resource group level (`RG-App`) grants access directly. An assignment at the subscription level (`Sub-Dev`) inherits down to the resource group.
Azure RBAC inheritance flows from management groups to subscriptions, then to resource groups, and finally to resources.
3
Examine Entra ID roles and Administrative Units.
Entra ID roles (like Global Reader) and Administrative Units are directory-level features and do not govern subscription resource access.
Ensures directory management features are not confused with Azure resource management plane (RBAC) controls.

Key Concept

Azure RBAC role assignments can be applied at different scopes, and child resources inherit role assignments from parent scopes (Management Groups, Subscriptions, and Resource Groups).
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic