Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

Your company has an Azure subscription containing multiple development environments. You need to delegate the management of virtual machines to a development operations team. The team must be able to perform all virtual machine operations except deleting virtual machines. The delegation must follow the principle of least privilege, apply only to the development subscription, and be assigned to a Microsoft Entra ID security group. You decide to create a custom RBAC role to meet these requirements.

In which order should you perform the steps to configure and apply the custom role?

  1. 1Run `Get-AzRoleDefinition` to export an existing built-in role to a JSON template.
  2. 2Modify the JSON file to include the required permissions in the `Actions` array, exclude delete permissions using the `NotActions` array, and specify the subscription ID in the `AssignableScopes` array.
  3. 3Run `New-AzRoleDefinition` to register the custom role in the Azure tenant using the modified JSON file.
  4. 4Assign the registered custom role to the designated Microsoft Entra security group at the subscription scope.

Answer

Export the template, modify the JSON file to set actions and assignable scopes, register the custom role in the tenant, and then assign the role to the Entra ID security group at the subscription scope.
To create and apply a custom Azure RBAC role, you must follow a structured lifecycle. First, retrieve a JSON template using an existing role. Second, customize the `Actions`, `NotActions`, and `AssignableScopes` fields inside the JSON to align with least privilege and target scope. Third, register the custom role within the Microsoft Entra tenant using the command `New-AzRoleDefinition`. Finally, assign the registered role to the Microsoft Entra ID security group at the desired subscription scope.

Step-by-Step Solution

1
Run the `Get-AzRoleDefinition` command with the name of a built-in role (e.g., Virtual Machine Contributor) and export the output to a JSON file.
A local JSON file containing the schema of the role definition is created.
Creating a custom role from scratch is error-prone; exporting an existing role definition provides a correctly formatted JSON schema.
2
Open the JSON file and configure `Actions` to include `Microsoft.Compute/virtualMachines/*`, set `NotActions` to include `Microsoft.Compute/virtualMachines/delete`, and configure `AssignableScopes` to target the subscription ID.
The JSON file is populated with correct permissions and scope limitations.
Setting `Actions` and `NotActions` meets the access requirements, and defining the subscription scope prevents the custom role from being assigned at unauthorized scopes.
3
Execute the `New-AzRoleDefinition` command, passing the path to the modified JSON file.
The custom role is registered and becomes available for assignment in the Azure tenant.
Before a custom role can be assigned to security principals, it must be officially registered in the tenant.
4
Assign the custom role to the Microsoft Entra ID security group at the subscription scope using the Azure Portal, CLI, or PowerShell.
Members of the security group receive the specified permissions on the target subscription.
The final step is to assign the registered custom role to the security group to grant active permissions.

Key Concept

Azure Custom Role Lifecycle and Assignment
Rate this question

Topics

Azure RBAC and Subscription Governance