Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC)

A company has an Azure Management Group named MG-Sales. You need to assign permissions to a security officer. The officer must be able to assign roles and delegate access permissions for all subscriptions within MG-Sales, but should not be allowed to create or modify virtual machines or databases. Which configuration should you assign to the security officer to meet these requirements?

  1. The User Access Administrator role at the Management Group scopeAnswer
  2. B
    The Owner role at the Management Group scope
  3. C
    An Azure Policy definition assigned to the Management Group
  4. D
    A ReadOnly resource lock applied to the Management Group

Answer

The User Access Administrator role at the Management Group scope
The correct answer is the User Access Administrator role at the Management Group scope. This built-in role allows the security officer to manage user access (assign roles) to Azure resources, and because it is assigned at the Management Group level, these permissions inherit down to all subscriptions. Unlike the Owner role, it does not grant permissions to create or modify resources such as virtual machines or databases, which aligns with the principle of least privilege.

Step-by-Step Solution

1
Analyze the permission requirements.
The target user needs role delegation capabilities but must be blocked from resource creation/modification.
This establishes the scope of control to focus on access management only.
2
Evaluate the inheritance scope.
The target scope is a Management Group containing multiple subscriptions.
Assigning permissions at the Management Group level ensures the settings propagate down to all child subscriptions through inheritance.
3
Select the built-in role.
Choose User Access Administrator over Owner.
While both allow role assignments, the Owner role also allows resource modification, which violates the restriction. User Access Administrator isolates role delegation without resource-plane management rights.

Key Concept

Azure Role-Based Access Control (RBAC) Built-in Roles and Scope Inheritance
Estimated Time:1m 0s
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic