Examkin

Question

Difficulty: HardAzure Role Assignments and Scopes

Your organization has a Microsoft Entra ID tenant and the following Azure resource hierarchy:

* Management Group: `MG-Finance`
* Subscription: `Sub-Finance-Prod`
* Resource Group: `RG-Finance-Sec`
* Storage Account: `safinancedata`

A user named Admin1 is assigned the Microsoft Entra ID Global Administrator role.
A user named User2 is assigned the Reader role at the `Sub-Finance-Prod` subscription level.

You need to configure the environment to meet the following requirements:
1. Admin1 must be able to assign the Reader role to new users at the `RG-Finance-Sec` resource group level.
2. User2 must be able to read and write blob data in a container within the `safinancedata` storage account, but must not have control plane write permissions to any resource in the subscription.

Which of the following actions should you perform to meet these requirements?

  1. A
    Use Admin1's Global Administrator role to directly assign User2 the Contributor role on the storage account, as Microsoft Entra ID administrator roles automatically inherit access to manage all subscription resources.
  2. Elevate Admin1's access in Microsoft Entra ID to grant the User Access Administrator role at the root scope, and then assign User2 the Storage Blob Data Contributor role at the storage account level.Answer
  3. C
    Elevate Admin1's access in Microsoft Entra ID to grant the User Access Administrator role at the root scope, and then assign User2 the Contributor role at the storage account level.
  4. D
    Elevate Admin1's access in Microsoft Entra ID to grant the User Access Administrator role at the root scope, assign User2 the Contributor role at the subscription level, and then create a custom deny assignment at the subscription level to block write access to all resources except the storage account.

Answer

Elevate Admin1's access in Microsoft Entra ID to grant the User Access Administrator role at the root scope, and then assign User2 the Storage Blob Data Contributor role at the storage account level.
To manage Azure resources, a Microsoft Entra ID Global Administrator must first elevate access to receive the User Access Administrator role at the root management group scope. To allow User2 to write blobs without granting control plane write access, the Storage Blob Data Contributor role must be assigned at the storage account level. This provides data plane write capabilities while User2's read-only access (Reader) is inherited from the subscription.

Step-by-Step Solution

1
Determine the role assignment capability of Admin1.
Identify that Admin1 has the Microsoft Entra ID Global Administrator role, which does not automatically grant permissions to manage Azure resources.
By default, Microsoft Entra ID roles and Azure RBAC roles are separate. To manage role assignments on Azure resources, Admin1 must elevate access in Microsoft Entra ID properties to receive the User Access Administrator role at the root management group scope.
2
Analyze User2's current permissions and access requirements.
User2 has Reader permissions at the subscription level. They need to read and write blob data inside a container within the storage account without getting write access to other resources.
Reader is a control plane role and is inherited down to the storage account. To allow write operations on the data plane (blobs) without granting control plane write access (such as modifying firewalls or deleting resources), the Storage Blob Data Contributor role must be assigned at the storage account scope.
3
Identify the correct configuration that combines these two actions.
Admin1 elevates access in Microsoft Entra ID to assign roles, and assigns User2 the Storage Blob Data Contributor role at the storage account scope.
This satisfies both requirements: Admin1 gains the permission to manage role assignments, and User2 obtains the necessary data-plane write access while retaining their read-only control-plane access elsewhere.

Key Concept

Azure RBAC scopes, role inheritance, separation of control plane and data plane, and Entra ID access elevation.
Estimated Time:2m 30s
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic