An organization's Azure infrastructure is organized under a management group named MG-Enterprise, which contains an Azure subscription named Sub-Operations. Within this subscription, there is a resource group named RG-AppPlatform containing virtual machines, storage accounts, and web apps. You need to assign the appropriate roles to various users and identities to meet their administrative requirements. Match each user or identity requirement to the most appropriate Azure RBAC or Microsoft Entra ID role to enforce the principle of least privilege.
- User1 needs to delegate Azure RBAC role assignments to team members within RG-AppPlatform but must not have the ability to create, delete, or modify Azure resources.User Access Administrator (assigned at the resource group scope)
- Group1 (support team security group) needs to start, stop, and restart virtual machines in RG-AppPlatform to perform maintenance, but must not be able to modify the virtual machine sizes or configuration.Virtual Machine Operator (assigned at the resource group scope)
- AppService-MSI (a system-assigned managed identity) needs to read files from blob storage containers in RG-AppPlatform but must not be able to view storage account access keys or modify configurations.Storage Blob Data Reader (assigned at the storage account scope)
- User2 needs to create and manage user accounts and groups in the Microsoft Entra ID tenant, but must not have any permissions to manage Azure resources.User Administrator (assigned at the Microsoft Entra ID tenant scope)
Answer
Match the requirements to the correct built-in roles: User1 matches User Access Administrator; Group1 matches Virtual Machine Operator; AppService-MSI matches Storage Blob Data Reader; User2 matches User Administrator.
The correct pairings map each role to its specific boundary and least privilege requirement. User Administrator is an Entra ID directory role required for tenant-level user/group management. User Access Administrator is an Azure RBAC role for managing role assignments. Virtual Machine Operator permits VM operations without configuration modification. Storage Blob Data Reader is a data-plane role allowing blob reads without exposing keys.
Step-by-Step Solution
Key Concept
Azure RBAC vs Microsoft Entra ID roles, and control plane vs data plane role configuration.