Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

An enterprise is designing a subscription governance model to manage resources across multiple departments. You need to implement a management group hierarchy and delegate resource access using a custom Azure RBAC role. The solution must ensure that administrative access is inherited across all department subscriptions and adheres to the principle of least privilege.

Which sequence of steps should you perform?

  1. 1Create the management group hierarchy under the Tenant Root Group to reflect the organizational departments.
  2. 2Associate the departmental subscriptions with their designated management groups in the hierarchy.
  3. 3Define and create the custom Azure RBAC role with the AssignableScopes property configured with the management group resource paths.
  4. 4Create Microsoft Entra ID security groups for the departmental administrative roles and add the respective users.
  5. 5Create role assignments that map the Microsoft Entra ID security groups to the custom RBAC role at the management group scope.

Answer

The correct sequence is to first create the management group hierarchy, associate the departmental subscriptions with their designated management groups, define and create the custom Azure RBAC role specifying the management group paths in the AssignableScopes, create Microsoft Entra ID security groups for the administrative roles, and finally create the role assignments mapping the security groups to the custom role at the management group scope.
Establishing governance begins with defining the resource hierarchy (management groups) and placing subscriptions within that hierarchy. Once the hierarchy is established, the custom role definition is created with AssignableScopes set to the management groups. Then, Microsoft Entra ID security groups are created to hold users, and finally, the custom role is assigned to the security groups at the management group scope to enable inheritance.

Step-by-Step Solution

1
Create the management group hierarchy.
Management groups are available in the tenant.
Establishing the management group structure is required before configuring assignable scopes or assigning permissions at these scopes.
2
Associate subscriptions with the management groups.
Subscriptions are organized under their respective management groups.
This enables inheritance of access controls and policies from the parent management groups down to the subscriptions.
3
Define and create the custom Azure RBAC role.
The custom RBAC role is registered and available for assignment.
The custom role's AssignableScopes must reference the existing management group resource IDs, so the hierarchy must exist first.
4
Create Microsoft Entra ID security groups.
Security groups representing operational roles are populated with users.
Assigning roles to security groups rather than individual users aligns with the principle of least privilege and simplifies management.
5
Assign the custom RBAC role to the security groups.
Role assignments are created at the management group scope.
This completes the delegation of access, ensuring users in the groups inherit the necessary permissions across all subscriptions in the management group.

Key Concept

Azure Management Groups allow logical grouping of subscriptions to apply access control, policies, and compliance settings. Custom RBAC roles require an AssignableScopes property that limits where the role can be assigned, and permissions are inherited from parent scopes (Management Groups) to child scopes (Subscriptions, Resource Groups, and Resources).
Rate this question

Topics

Azure RBAC and Subscription Governance