Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

An organization wants to delegate custom permissions to a development team. The team needs the ability to restart and manage virtual machines across all subscriptions nested under the 'R&D' management group. You must design a custom role that permits virtual machine management operations but explicitly prevents virtual network configuration modifications. The custom role must be scope-constrained so it can only be assigned to subscriptions under the 'R&D' management group. You need to create this custom role and assign it to the development team's Microsoft Entra ID group. Which sequence of actions should you perform?

  1. 1Retrieve the resource ID of the 'R&D' management group.
  2. 2Create a JSON definition file containing the custom role's permissions and specify the management group's resource ID in the AssignableScopes list.
  3. 3Register the custom role in the tenant by importing the JSON definition file using the Azure CLI or Azure PowerShell.
  4. 4Assign the registered custom role to the development team's Microsoft Entra ID group at the 'R&D' management group scope.

Answer

Retrieve the resource ID of the 'R&D' management group, create a JSON definition file containing the custom role's permissions and specifying the management group's resource ID in the AssignableScopes list, register the custom role in the tenant by importing the JSON definition file using the Azure CLI or Azure PowerShell, and finally assign the registered custom role to the development team's Microsoft Entra ID group at the 'R&D' management group scope.
The correct sequence begins with identifying the resource ID of the 'R&D' management group. This ID must be included in the AssignableScopes property of the custom role JSON definition. Once the JSON file is fully configured, the custom role is registered in the Azure Active Directory (Microsoft Entra ID) tenant. Only after the custom role is successfully registered can it be assigned to the target security group at the management group scope.

Step-by-Step Solution

1
Retrieve the resource ID of the 'R&D' management group.
You obtain the precise resource path of the target management group.
The custom role's AssignableScopes property requires the exact resource path of the management group to restrict where the role can be defined and used.
2
Create a JSON definition file detailing permissions and scopes.
A complete JSON role definition document with Actions, NotActions, and AssignableScopes is drafted.
This file establishes the actual configuration of the custom role, ensuring the exclusion of network permissions and target scope restrictions.
3
Import the JSON definition file to register the role.
The custom role definition is registered in the Azure tenant database.
The role must be registered in Azure before Azure Resource Manager can process assignments for it.
4
Assign the custom role to the Microsoft Entra ID group.
The security group is granted the permissions defined in the custom role at the management group scope.
Assigning the role at the management group scope ensures all nested subscriptions inherit the permissions automatically.

Key Concept

Azure Custom RBAC Role Lifecycle and Scope Inheritance
Rate this question

Topics

Azure RBAC and Subscription Governance