Examkin

Question

Difficulty: Very hardAzure Role Assignments and Scopes

An organization has the following Azure resource hierarchy and configuration:
- A management group named MG-Production contains an Azure subscription named Sub-App.
- Sub-App contains a resource group named RG-Data.
- RG-Data contains a storage account named storage1.
- A ReadOnly resource lock is applied directly to the storage1 resource.

The following security principals are configured:
- User1 is a Microsoft Entra ID user with the Global Administrator directory role. The 'Access management for Azure resources' setting is disabled in the directory properties.
- User2 has the Reader role assigned at the MG-Production level and the Storage Blob Data Contributor role assigned at the RG-Data level.
- User3 has the Contributor role assigned at the Sub-App level.

All users attempt to access resources using Microsoft Entra ID authentication. Which of the following describes the effective permissions of the users?

  1. User1 cannot view the properties of storage1, User2 can upload blobs to storage1, and User3 is blocked from regenerating access keys for storage1.Answer
  2. B
    User1 can view and manage storage1 due to their Global Administrator role, User2 is blocked from uploading blobs by the ReadOnly lock, and User3 can regenerate access keys because their Contributor role inherits from a higher scope.
  3. C
    User1 cannot view the properties of storage1, User2 can upload blobs to storage1, and User3 can upload blobs to storage1 using Microsoft Entra ID authentication because the Contributor role includes data-plane access.
  4. D
    User1 cannot view the properties of storage1, User2 is blocked from uploading blobs by the ReadOnly lock, and User3 can regenerate access keys because subscription-level permissions override resource-level locks.

Answer

User1 cannot view the properties of storage1, User2 can upload blobs to storage1, and User3 is blocked from regenerating access keys for storage1.
The correct option is correct because User1's Global Administrator directory role does not grant Azure resource access unless the access management elevation toggle is enabled. User2 holds the Storage Blob Data Contributor role, which allows them to upload blobs since resource locks only restrict Azure Resource Manager control-plane actions and do not block data-plane operations. Finally, User3 is prevented from regenerating access keys because key regeneration is a control-plane write action that is explicitly blocked by the ReadOnly lock applied to the storage account.

Step-by-Step Solution

1
Evaluate User1's permissions based on their directory role.
User1 has no access to subscription resources.
Microsoft Entra ID administrator roles (like Global Administrator) do not automatically grant permissions to Azure subscription resources. Since 'Access management for Azure resources' is disabled, User1 has no inherited roles in the subscription.
2
Evaluate User2's permissions and the impact of the ReadOnly lock on data plane actions.
User2 can upload blobs to storage1.
User2 inherits control-plane read access (from the Reader assignment at the management group level) and has direct data-plane write access (from the Storage Blob Data Contributor assignment at the resource group level). The ReadOnly resource lock applied to the storage account only prevents control-plane modifications (write/delete) and does not block data-plane actions like uploading blobs.
3
Evaluate User3's permissions and the impact of the ReadOnly lock on control plane actions.
User3 is blocked from regenerating access keys on storage1.
User3 inherits the Contributor role, which would normally allow regenerating storage account keys. However, key regeneration is a control-plane write operation. The ReadOnly lock applied directly to the resource blocks all control-plane write and delete operations, regardless of whether the Contributor role was inherited from a higher scope.

Key Concept

Azure resource locks only restrict control-plane (management) operations and do not block data-plane operations. Additionally, Microsoft Entra ID administrative roles do not implicitly grant Azure RBAC permissions unless explicitly elevated, and subscription Contributor does not provide data-plane access for storage.
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic