An enterprise has the following Azure management group and subscription hierarchy:

- Tenant Root Group
- Corp-Production (Management Group)
- Sub-App1 (Subscription for Production Application 1)
- Sub-App2 (Subscription for Production Application 2)
- Sub-HubNet (Subscription for Core Hybrid Networking Services)

You are designing a governance and identity strategy that must meet the following requirements:
1. A team of external security auditors must have read-only access to view configurations across Sub-App1, Sub-App2, and all future production application subscriptions.
2. The auditors must have absolutely no access to Sub-HubNet due to strict network security compliance.
3. Access management must minimize administrative overhead and ensure that new production application subscriptions automatically inherit the auditor permissions.
4. Any new production subscription must automatically deploy a standard diagnostic setting that streams activity logs to a central Log Analytics workspace.

Which governance and access control design should you recommend?

A
Create a new management group named Corp-Prod-Apps under Corp-Production. Move Sub-App1 and Sub-App2 into Corp-Prod-Apps, leaving Sub-HubNet directly under Corp-Production. Assign the Reader role at the Corp-Prod-Apps scope to a Microsoft Entra ID security group containing the auditors. Assign an Azure Policy with the Deny effect at the Corp-Production scope to block the deployment of any subscription that does not have diagnostic settings pre-configured.
Create a new management group named Corp-Prod-Apps under Corp-Production. Move Sub-App1 and Sub-App2 into Corp-Prod-Apps, leaving Sub-HubNet directly under Corp-Production. Assign the Reader role at the Corp-Prod-Apps scope to a Microsoft Entra ID security group containing the auditors. Assign an Azure Policy with the DeployIfNotExists effect at the Corp-Production scope to deploy the diagnostic settings.Answer
C
Assign the Reader role at the Corp-Production management group scope directly to each auditor's Microsoft Entra ID user account. Assign an Azure Policy with the DeployIfNotExists effect at the Corp-Production scope to deploy the diagnostic settings, and configure an Azure RBAC Deny assignment at the Sub-HubNet scope for the auditor accounts.
D
Create a new management group named Corp-Prod-Apps under Corp-Production. Move Sub-App1 and Sub-App2 into Corp-Prod-Apps, leaving Sub-HubNet directly under Corp-Production. In Microsoft Entra Privileged Identity Management (PIM), assign the Reader role to the auditor accounts at the Corp-Prod-Apps scope as a permanently active assignment. Assign an Azure Policy with the DeployIfNotExists effect at the Corp-Production scope to deploy the diagnostic settings.

Answer

Create a new management group named Corp-Prod-Apps under Corp-Production, move the application subscriptions there, assign the Reader role at the new management group scope to a Microsoft Entra ID security group for the auditors, and deploy the diagnostic settings using an Azure Policy with the DeployIfNotExists effect at the Corp-Production scope.

The correct design restructures the management group hierarchy to segregate the subscriptions. By creating a new 'Corp-Prod-Apps' management group under 'Corp-Production' and placing the application subscriptions there, you isolate 'Sub-HubNet' from the inheritance path. Assigning the Reader role to a Microsoft Entra ID security group at the new management group scope ensures that permissions are inherited by all existing and future application subscriptions without manual intervention, satisfying the principle of least privilege and scalability. Additionally, assigning an Azure Policy with the DeployIfNotExists effect at the 'Corp-Production' scope guarantees that all production subscriptions automatically deploy and configure the required diagnostic settings upon resource creation.

Step-by-Step Solution

Analyze subscription requirements and identify resource scope boundaries.

Determine that Sub-HubNet must be excluded from auditor access, while Sub-App1, Sub-App2, and future application subscriptions must inherit access.

This establishes the scope boundaries and rules out assigning permissions at the root Corp-Production management group level directly, as that would grant access to Sub-HubNet via inheritance.

Design a management group structure to isolate the scopes.

Introduce a new child management group (Corp-Prod-Apps) under Corp-Production to hold only application subscriptions, leaving Sub-HubNet at a sibling level.

This allows for scalable RBAC inheritance on application subscriptions while keeping Sub-HubNet isolated.

Define the identity and RBAC assignment method.

Create a Microsoft Entra ID security group for the auditors and assign the Reader role at the Corp-Prod-Apps management group scope.

Assigning RBAC roles to groups rather than individual users follows identity governance best practices and minimizes administrative overhead.

Determine the policy effect for automatic remediation of diagnostic settings.

Select the DeployIfNotExists policy effect and assign it at the Corp-Production management group level.

A DeployIfNotExists policy automatically deploys the diagnostic settings if they are missing on new subscriptions, unlike a Deny policy which only blocks non-compliant deployments.

Key Concept

Azure RBAC inheritance, management group hierarchy design, and Azure Policy remediation effects.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics