Examkin

Question

Difficulty: EasyManagement Groups Hierarchies

A healthcare provider, MedPulse Dynamics, organizes its subscriptions using the following Management Group hierarchy:
- Tenant Root Group
- Clinical-MG
- Subscription 1 (Clinical Apps)
- Resource Group A
- Billing-MG
- Subscription 2 (Billing Portal)

An administrator assigns the Reader role to a user at the Clinical-MG level. What is the user's access level to Resource Group A?

  1. The user has Reader access to Resource Group A because the role is inherited down the hierarchy.Answer
  2. B
    The user has Reader access to Resource Group A, but this permission can be blocked by creating a custom Deny Reader role assignment directly on Resource Group A.
  3. C
    The user has no access to Resource Group A because applying a ReadOnly resource lock at the Clinical-MG level blocks all RBAC role inheritance.
  4. D
    The user has Reader access to Resource Group A, but only if a policy is assigned to the Tenant Root Group that explicitly enables RBAC role inheritance.

Answer

The user has Reader access to Resource Group A because the role is inherited down the hierarchy.
The correct answer is correct because Azure RBAC role assignments inherit down the resource hierarchy. Since the Reader role is assigned at the Clinical-MG level, any child resources—including Subscription 1 and Resource Group A—will inherit this assignment, granting the user Reader access.

Step-by-Step Solution

1
Identify the scope of the RBAC role assignment.
The Reader role is assigned at the Clinical-MG management group scope.
This determines the root point from which permissions start inheriting.
2
Trace the hierarchy path from the assignment scope to the target resource.
Resource Group A is nested inside Subscription 1, which is a direct child of Clinical-MG.
Permissions flow down the tree to all children in the branch.
3
Determine the effective permission on Resource Group A.
The Reader permission inherits down to Subscription 1 and then to Resource Group A.
Azure RBAC assignments flow down through Management Groups to subscriptions, resource groups, and individual resources without requiring manual activation or being blocked by standard locks.

Key Concept

Azure RBAC inheritance flows down the Management Group hierarchy to child subscriptions and resources, and cannot be blocked by user-defined deny assignments or resource locks.
Rate this question

Topics

Management Groups Hierarchies

More questions from this topic