Your organization manages resources across a multi-layered Azure resource hierarchy. An administrator needs to configure permissions for various identities while strictly adhering to the principle of least privilege.
Match each security identity and business requirement to the most restrictive (least privilege) Azure Role-Based Access Control (RBAC) role and scope combination that satisfies the requirement.
- A VM system-assigned managed identity (App-VM-MSI) that must retrieve application database connection strings stored as secrets from the vault named kv-prod-01 in App-RG. The key vault is configured to use Azure RBAC for authorization.Key Vault Secrets User role assigned at the /subscriptions/sub-prod-01/resourceGroups/App-RG/providers/Microsoft.KeyVault/vaults/kv-prod-01 scope.
- A security auditing group (Security-Auditors) that must view the configuration settings of all resources and check Azure Policy compliance states across all subscriptions under the Corp-MG management group, but must not view resource data or credentials.Reader role assigned at the /providers/Microsoft.Management/managementGroups/Corp-MG scope.
- A deployment service principal (Deploy-Agent) that must deploy virtual machines and storage accounts in Dev-RG, and must also assign required RBAC roles to those resources' managed identities during deployment.Contributor and User Access Administrator roles assigned at the /subscriptions/sub-dev-01/resourceGroups/Dev-RG scope.
- A data synchronization service principal (Data-Sync-SP) that must read, write, and delete blobs inside the storage account sa-prod-data in Data-RG, but must not be allowed to modify the storage account's network firewalls or access keys.Storage Blob Data Contributor role assigned at the /subscriptions/sub-prod-01/resourceGroups/Data-RG/providers/Microsoft.Storage/storageAccounts/sa-prod-data scope.
Answer
The correct matches pair App-VM-MSI with Key Vault Secrets User at the vault scope; Security-Auditors with Reader at the Corp-MG management group scope; Deploy-Agent with Contributor and User Access Administrator at the Dev-RG scope; and Data-Sync-SP with Storage Blob Data Contributor at the sa-prod-data scope.
The correct pairings accurately select roles mapped to the least privilege model and correct scopes. The Reader role at the management group level ensures read-only metadata visibility across all child subscriptions. The Key Vault Secrets User role at the vault scope allows the application VM to read secrets without permitting secrets management. The combination of Contributor and User Access Administrator at the resource group level enables resource deployment and role assignment without granting full subscription ownership. The Storage Blob Data Contributor role at the storage account scope allows blob manipulations without exposing control plane operations.
Step-by-Step Solution
Key Concept
Azure RBAC configurations must separate control plane and data plane permissions, leverage management group and resource group scopes for inheritance, and combine specific built-in roles to meet complex automation requirements without violating the principle of least privilege.
Estimated Time:3m 0s