Examkin

Question

Difficulty: HardManagement Groups Hierarchies

An organization named Meridian Vanguard configures the following Azure Management Group (MG) hierarchy:

* Tenant Root Group
* Corporate-MG
* Production-MG
* App-Sub-01 (Subscription)
* Development-MG
* Dev-Sub-01 (Subscription)

An administrator named Alice needs to reorganize the environment by moving the subscription App-Sub-01 from Production-MG to Development-MG.

Alice has the following Azure role assignments:
* Owner role on the App-Sub-01 subscription
* Reader role on both Corporate-MG and Production-MG
* Contributor role on Development-MG

What is the outcome when Alice attempts to move the subscription?

  1. A
    The move succeeds because Alice is an Owner on the App-Sub-01 subscription, which grants full control over its parent association.
  2. B
    The move fails because Alice lacks the required write permissions on the target management group (Development-MG).
  3. The move fails because Alice lacks the required write permissions on the source management group (Production-MG).Answer
  4. D
    The move fails because changing a subscription's parent management group requires the User Access Administrator role at the Tenant Root Group level.

Answer

The move fails because Alice lacks the required write permissions on the source management group (Production-MG).
To move an Azure subscription to a new parent management group, an administrator must have write permissions at three distinct scopes: the subscription itself, the target management group, and the source management group. While Alice has Owner permissions on the subscription and Contributor permissions on the target (Development-MG), she only has Reader permissions on the source (Production-MG). Because the Reader role does not grant write permissions (specifically Microsoft.Management/managementGroups/subscriptions/write), the operation is blocked.

Step-by-Step Solution

1
Verify the permission requirements for moving a subscription within a management group hierarchy.
Moving a subscription requires write permissions (Microsoft.Management/managementGroups/subscriptions/write) on both the source and target management groups, as well as write permissions on the subscription itself.
Moving a subscription is an administrative change that modifies the child collections of both management groups and updates the subscription's parent metadata.
2
Evaluate Alice's permissions against the target management group (Development-MG) and the subscription (App-Sub-01).
Alice has Contributor permissions on the target MG (which includes write access) and Owner permissions on the subscription (which includes write access).
These roles satisfy the target-side and resource-side requirements of the move operation.
3
Evaluate Alice's permissions against the source management group (Production-MG).
Alice only has the Reader role on Production-MG, which does not grant write permissions.
Without write permissions on the source management group, Alice cannot authorize the removal of the subscription from that management group, causing the operation to fail.

Key Concept

Moving subscriptions between management groups requires write permissions at the source management group, the target management group, and on the subscription itself.
Estimated Time:2m 0s
Rate this question

Topics

Management Groups Hierarchies

More questions from this topic