Examkin

Question

Difficulty: HardAzure Role Assignments and Scopes

An organization has a Microsoft Entra ID tenant and the following Azure resource hierarchy:

* Management Group: `MG-Production`
* Azure Subscription: `Sub-App1`
* Resource Group: `RG-Database`
* Azure SQL Database: `db-prod`

A user named User1 is a member of an Entra ID security group named `Group-DataOps`.

The following role assignments are configured:
1. `Group-DataOps` is assigned the Contributor role at the `MG-Production` scope.
2. User1 is assigned the Reader role at the `Sub-App1` scope.
3. User1 is assigned the User Access Administrator role at the `RG-Database` scope.
4. User1 is assigned the Global Administrator directory role in Microsoft Entra ID.

Which statement describes the effective permissions of User1?

  1. A
    User1 has only Reader permissions within Sub-App1 because the direct Reader assignment at the subscription level overrides the inherited Contributor permissions from the group assignment.
  2. B
    User1 automatically has Owner permissions for all resources in Sub-App1 because the Microsoft Entra ID Global Administrator role inherits full control plane access to all subscriptions by default.
  3. User1 has Contributor permissions for all resources in Sub-App1 and can manage Azure role assignments within RG-Database.Answer
  4. D
    User1 is blocked from managing role assignments within RG-Database because the Contributor role inherited from MG-Production acts as a deny assignment for administrative actions.

Answer

User1 has Contributor permissions for all resources in Sub-App1 and can manage Azure role assignments within RG-Database.
The correct answer is correct because Azure RBAC role assignments are cumulative (additive). The user inherits the Contributor role from the security group assignment at the management group level, which applies to all resources within the subscription. The direct Reader assignment at the subscription level does not restrict this access. Furthermore, the direct assignment of the User Access Administrator role at the resource group level grants the user the ability to manage role assignments specifically within that resource group.

Step-by-Step Solution

1
Evaluate the management group role assignment and its inheritance down the hierarchy.
User1 is a member of Group-DataOps, which is assigned the Contributor role at the MG-Production scope. Since permissions inherit downward, User1 inherits Contributor permissions for the entire Sub-App1 subscription, including RG-Database and db-prod.
Azure RBAC roles assigned at a higher scope in the hierarchy (such as a management group) automatically inherit to all child scopes (subscriptions, resource groups, and resources).
2
Evaluate the direct subscription role assignment and check for overrides.
User1 is directly assigned the Reader role at the Sub-App1 scope. However, Azure RBAC roles are additive. The direct Reader assignment does not restrict or override the inherited Contributor permissions.
Standard Azure RBAC is strictly additive. There is no concept of a standard 'deny' or restriction role assignment that overrides an inherited 'allow' permission.
3
Evaluate the resource group role assignment and assess access management capabilities.
User1 is assigned the User Access Administrator role at the RG-Database scope. This grants the Microsoft.Authorization/* permission, allowing User1 to assign and remove roles within RG-Database, while retaining Contributor access from the inherited assignment.
The User Access Administrator role is a built-in role that allows managing access to Azure resources. Assigning it at the resource group level restricts this permission to that resource group and its child resources.
4
Assess the impact of the Microsoft Entra ID directory role.
User1 is assigned the Global Administrator directory role. By default, this does not grant any access to subscriptions or Azure resources within the tenant.
Microsoft Entra ID roles (tenant-level administration) and Azure RBAC roles (subscription-level resource administration) are separate authorization systems. A Global Administrator must explicitly elevate access to manage Azure subscriptions if needed.

Key Concept

Azure RBAC scopes, inheritance, and the additive nature of role assignments compared to Microsoft Entra ID roles.
Estimated Time:2m 0s
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic