Examkin

Question

Difficulty: MediumAzure Role Assignments and Scopes

An organization has an Azure resource hierarchy with a subscription named sub-billing-data that contains a resource group named rg-invoice-processing. You need to configure access control to meet the following requirements:

* User1 must be able to view all resource configurations and view all role assignments within the sub-billing-data subscription, but must not be able to make any changes.
* User2 must be able to assign Azure roles to other users at the rg-invoice-processing resource group scope, but must not have access to other resource groups. User2 is currently a Microsoft Entra ID Global Administrator and has no Azure RBAC assignments.

Which two actions should you perform? (Select two.)

  1. Assign the Reader role to User1 at the sub-billing-data subscription scope.Answer
  2. Assign the User Access Administrator role to User2 at the rg-invoice-processing resource group scope.Answer
  3. C
    Assign the Contributor role to User2 at the rg-invoice-processing resource group scope.
  4. D
    Assign the Global Administrator role to User2 at the rg-invoice-processing resource group scope.

Answer

Assign the Reader role to User1 at the subscription scope, and assign the User Access Administrator role to User2 at the resource group scope.
The Reader role assigned at the subscription scope provides User1 with the necessary read-only permissions for all resources and role assignments. The User Access Administrator role assigned at the resource group scope enables User2 to manage access control strictly within that resource group, satisfying the principle of least privilege and scope containment.

Step-by-Step Solution

1
Determine the role and scope required for User1.
User1 needs read-only access to resources and access control settings across the entire subscription. The Reader role assigned at the subscription scope provides this capability.
The Reader role is a built-in role that allows viewing all resources and role assignments but does not grant permission to make changes.
2
Determine the role and scope required for User2.
User2 needs to manage access control at a specific resource group. The User Access Administrator role assigned at the resource group scope meets this requirement.
The User Access Administrator role allows managing role assignments but restricts access to the specified scope (the resource group), preventing broader subscription-level access.
3
Evaluate why User2's existing Global Administrator role is insufficient.
Microsoft Entra ID directory roles like Global Administrator do not automatically grant permissions to manage Azure resources.
Azure Resource Manager (RBAC) and Microsoft Entra ID use separate authorization systems, so explicit resource-level roles must be assigned.

Key Concept

Azure Role Assignments and Scopes
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic