Examkin

Question

Difficulty: Very hardAzure Role-Based Access Control (RBAC)

Determine if the following statement is true or false:

A developer who is assigned the Owner role for an Azure resource group can successfully create Azure SQL databases in that resource group, even if an Azure Policy is assigned at the parent subscription level to deny the creation of SQL databases.

Answer: Answer

Answer

The statement is false. Azure Policy restrictions are evaluated at resource deployment and take precedence over Azure Role-Based Access Control (RBAC) permissions, meaning even a user with the Owner role cannot create a resource that violates a Deny policy.
The statement is false. Azure Policy evaluates resource creation requests and applies restrictions independently of Azure RBAC permissions. An Owner role grants permissions under RBAC, but it does not grant the authorization to bypass active Azure Policy deny rules.

Step-by-Step Solution

1
Determine the user's authorization level under Azure RBAC.
The user has the Owner role on the resource group, which grants full management rights to all resources inside that resource group, including creation rights.
To evaluate what actions the user is authorized to attempt.
2
Determine the policy scope and restriction.
An Azure Policy denying SQL database creation is applied at the subscription level, which is a parent scope that automatically inherits down to the resource group.
To identify active policy rules that apply to the resource group.
3
Compare the precedence of RBAC and Azure Policy rules.
During resource deployment, Azure Policy is evaluated first. If a Deny policy is violated, the deployment is blocked even if the user has the RBAC permissions to create the resource.
To resolve conflicts between RBAC access permissions and Azure Policy constraints.

Key Concept

Azure RBAC vs. Azure Policy precedence
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic