Examkin

Question

Difficulty: HardAzure Role Assignments and Scopes

A company implements a governance strategy for its Azure resources. The environment includes a user account named Admin-User who is assigned the Global Administrator directory role in Microsoft Entra ID. No Azure Role-Based Access Control (RBAC) assignments have been made for Admin-User at any resource scope.

The resource hierarchy is structured as follows:
- Management Group: MG-Shared
- Subscription: Sub-Development
- Resource Group: RG-Web

Admin-User needs to assign the Virtual Machine Contributor role to a developer at the RG-Web scope.

Which configuration must be completed to enable Admin-User to assign this role?

  1. Elevate access in the Microsoft Entra properties to assign the User Access Administrator role at the root management group scope.Answer
  2. B
    Use the Global Administrator privileges to inherit the Owner role automatically on all subscriptions within the Microsoft Entra tenant.
  3. C
    Assign the User Access Administrator role to Admin-User within an Administrative Unit that contains the RG-Web resource group.
  4. D
    Remove the default Deny assignment inherited from the tenant root management group that blocks Microsoft Entra ID roles from managing subscriptions.

Answer

Elevate access in the Microsoft Entra properties to assign the User Access Administrator role at the root management group scope.
The correct option is correct because Microsoft Entra ID directory roles and Azure RBAC roles are separated. A Global Administrator has no default permissions on Azure subscriptions. To manage them, the administrator must elevate their access in Microsoft Entra properties, which temporarily assigns the User Access Administrator role at the root management group scope ('/'). This inherited role provides the authorization needed to make role assignments at any sub-scope, including the resource group level.

Step-by-Step Solution

1
Differentiate between Microsoft Entra ID directory roles and Azure RBAC roles.
Confirm that the Global Administrator directory role does not automatically grant access to subscriptions or resources within the Azure tenant.
Microsoft Entra ID and Azure Resource Manager run on separate identity and access control planes to ensure separation of duties.
2
Determine the mechanism to allow a Global Administrator to manage Azure subscription resources.
Identify that the administrator must toggle the 'Access management for Azure resources' option in the Microsoft Entra properties page.
This toggle explicitly authorizes the directory administrator to gain management access to the Azure resources.
3
Analyze the resulting role assignment and its inheritance scope.
The elevation assigns the User Access Administrator role at the root management group scope ('/'). This permission inherits down to all subscriptions, resource groups (including RG-Web), and resources in the tenant.
Once assigned at the root scope, the User Access Administrator role provides the necessary permissions to assign Azure RBAC roles (like Virtual Machine Contributor) at any level of the hierarchy.

Key Concept

Separation of planes between Microsoft Entra ID roles and Azure RBAC roles, and the process of elevating access to assign Azure RBAC roles.
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic