Examkin

Question

Difficulty: MediumAzure Role Assignments and Scopes

An organization manages an Azure environment with a subscription named Sub-ECommerce. The subscription contains a resource group named rg-payment.

A user named User1 is assigned the following roles:
- The Reader role at the Sub-ECommerce subscription scope
- The Contributor role at the rg-payment resource group scope
- The Global Reader role in Microsoft Entra ID

User1 attempts to create a new storage account inside the rg-payment resource group.

What is the outcome of User1's attempt?

  1. The storage account is created successfully, because Azure RBAC roles are additive and the Contributor role at the resource group level grants the required permissions.Answer
  2. B
    The creation fails, because the Reader role assigned at the subscription level is more restrictive and inherits down to override the Contributor role at the resource group level.
  3. C
    The creation fails, because the Microsoft Entra ID Global Reader role is a directory-level role that enforces read-only access on all Azure resources across the tenant.
  4. D
    The creation fails, because User1 must be assigned a role within an Administrative Unit that contains the rg-payment resource group.

Answer

The storage account is created successfully, because Azure RBAC roles are additive and the Contributor role at the resource group level grants the required permissions.
The correct answer is correct because Azure Role-Based Access Control (RBAC) is additive. When a user has multiple role assignments, the effective permission is the sum of those role assignments. In this scenario, the Reader role at the subscription level provides read access, while the Contributor role at the resource group level provides read/write access. Since the permissions are additive, the Contributor permissions apply to the resource group, allowing the user to create the storage account. The Microsoft Entra ID Global Reader role operates in the directory plane and does not restrict Azure resource access.

Step-by-Step Solution

1
Evaluate the Azure RBAC inheritance hierarchy and determine which roles apply to User1 at the resource group scope.
User1 inherits the Reader role from the subscription scope and has an explicit Contributor role assigned at the resource group scope.
Permissions are inherited down the resource hierarchy: Management Group -> Subscription -> Resource Group -> Resource.
2
Apply the additive principle of Azure RBAC roles to determine the effective permissions.
The effective permission of User1 on the resource group is Contributor, since Azure RBAC roles are additive (Reader+Contributor=Contributor\text{Reader} + \text{Contributor} = \text{Contributor}).
An assignment of a less restrictive role at a lower scope grants those permissions; it is not overridden by a more restrictive role inherited from a higher scope.
3
Assess the impact of the Microsoft Entra ID Global Reader role on the Azure subscription resource permissions.
The Microsoft Entra ID Global Reader role does not restrict or override Azure RBAC permissions.
Microsoft Entra ID roles and Azure RBAC roles are managed in separate control planes. Directory roles do not automatically override or block subscription data or resource plane access.

Key Concept

Azure RBAC roles are additive. Scope-specific assignments grant permissions that are not blocked by inherited roles at a higher scope.
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic