Examkin

Question

Difficulty: MediumAzure Role Assignments and Scopes

Your company has an Azure environment structured with the following resource hierarchy:

* Management Group: `MG-Retail`
* Subscription: `Sub-Retail-Prod`
* Resource Group: `RG-Store-Prod`
* Resource: Virtual Machine named `VM-Web-01`

A user named Admin1 is assigned the Microsoft Entra ID Global Administrator role, but currently has no explicit Azure RBAC role assignments. Admin1 needs to assign the Contributor role to a developer named User2 for the Virtual Machine `VM-Web-01`.

What must Admin1 do first to accomplish this?

  1. Configure the Access management for Azure resources setting in the Microsoft Entra admin center to grant Admin1 the User Access Administrator role at the root scope.Answer
  2. B
    Directly assign the Contributor role to User2 at the `VM-Web-01` resource level using default Global Administrator permissions.
  3. C
    Create an Administrative Unit, add the `Sub-Retail-Prod` subscription to it, and assign Admin1 the User Access Administrator role at the Administrative Unit scope.
  4. D
    Remove the default inheritance block on the `MG-Retail` management group to allow Global Administrator permissions to flow down to child resources.

Answer

Configure the Access management for Azure resources setting in the Microsoft Entra admin center to grant the Global Administrator the User Access Administrator role at the root scope.
To manage Azure resource role assignments, a Microsoft Entra ID Global Administrator must first toggle the 'Access management for Azure resources' setting in the Microsoft Entra admin center. This action grants the administrator the built-in User Access Administrator role at the root scope (//), which inherits down the entire hierarchy, permitting them to manage RBAC role assignments at all management group, subscription, resource group, and resource levels.

Step-by-Step Solution

1
Elevate access for the Microsoft Entra ID Global Administrator in the Microsoft Entra admin center settings.
Admin1 is assigned the User Access Administrator role at the root scope (//).
By default, Microsoft Entra ID tenant administration roles do not inherit permissions to manage Azure subscription resources. Elevating access bridges the identity and resource authorization planes.
2
Access the Access Control (IAM) pane of the target virtual machine, resource group, or subscription.
Role assignment capability becomes active for the administrator due to root-level User Access Administrator permissions.
The User Access Administrator role permits role assignment actions at all child levels in the resource hierarchy.
3
Assign the Contributor role to User2 at the `VM-Web-01` resource scope.
User2 receives the Contributor role on the virtual machine resource.
This completes the requirement of granting User2 the Contributor role for the virtual machine.

Key Concept

Elevating access for a Microsoft Entra ID Global Administrator to assign Azure RBAC roles
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic