Examkin

Question

Difficulty: HardAzure RBAC and Subscription Governance

Your company has an Azure landing zone with a Management Group named Production-MG, which contains multiple subscriptions. You are designing a governance strategy for a team of system administrators.

The administrators must be able to start, stop, and restart Azure Virtual Machines within all subscriptions under Production-MG. They must not be able to perform any other actions on the virtual machines, such as creating, deleting, or modifying them. You must enforce the principle of least privilege, minimize administrative overhead, and ensure that administrative access is granted only when required for active maintenance tasks.

Which design strategy should you recommend?

  1. A
    Define a custom Azure RBAC role with the assignable scope set to the Production-MG management group and the Actions array configured with explicit read, start, powerOff, and restart permissions. Assign this custom role directly to each administrator's individual Microsoft Entra ID user account at the Production-MG scope, and use Microsoft Entra Privileged Identity Management (PIM) to configure eligible assignments.
  2. B
    Define a custom Azure RBAC role with the assignable scope set to the Root Management Group. Create a Microsoft Entra ID security group containing the administrators, assign the custom role to the group, and use an Azure Policy definition with a Deny effect at the Production-MG scope to enforce that only those specific virtual machine actions can be performed.
  3. Define a custom Azure RBAC role with the assignable scope set to the Production-MG management group and the Actions array configured with explicit read, start, powerOff, and restart permissions. Create a Microsoft Entra ID security group containing the administrators, assign the custom role to this group at the Production-MG scope, and configure Microsoft Entra Privileged Identity Management (PIM) for Azure resources to make the security group members eligible for the role.Answer
  4. D
    Define a custom Azure RBAC role with the assignable scope set to the Production-MG management group and the Actions array configured with explicit read, start, powerOff, and restart permissions. Create a Microsoft Entra ID security group containing the administrators, assign the custom role to this group at the Production-MG scope, and configure Microsoft Entra Privileged Identity Management (PIM) for Azure resources to make the security group members permanently active in the role.

Answer

Define a custom Azure RBAC role with the assignable scope set to the Production-MG management group and the Actions array configured with explicit read, start, powerOff, and restart permissions. Create a Microsoft Entra ID security group containing the administrators, assign the custom role to this group at the Production-MG scope, and configure Microsoft Entra Privileged Identity Management (PIM) for Azure resources to make the security group members eligible for the role.
The correct strategy involves defining a custom Azure RBAC role with explicit virtual machine power action permissions scoped to the Production-MG management group. Assigning this role to a Microsoft Entra ID security group at the management group level ensures that all subscriptions underneath inherit the permissions, minimizing administrative overhead. Configuring Microsoft Entra Privileged Identity Management (PIM) with eligible assignments ensures just-in-time (JIT) access, allowing administrators to activate the role only during active maintenance windows, which complies with the principle of least privilege.

Step-by-Step Solution

1
Define a custom Azure RBAC role with the minimum required actions at the Production-MG scope.
The role permissions are restricted to explicit read and virtual machine action operations (read, start, powerOff, and restart), preventing other management actions.
This enforces the principle of least privilege by ensuring administrators only have the specific permissions needed for virtual machine power state operations.
2
Create a Microsoft Entra ID security group and assign the custom RBAC role to this group at the Production-MG scope.
Permissions inherit down to all subscriptions and resource groups under Production-MG without needing individual resource-level role assignments.
Assigning roles to groups instead of individual users minimizes administrative overhead and adheres to identity governance best practices.
3
Configure Microsoft Entra Privileged Identity Management (PIM) for Azure resources, setting the administrators' assignments as eligible.
Administrators do not have active access by default, but can request just-in-time activation of the role when needed for maintenance tasks.
This satisfies the requirement that administrative access is granted only when required for active tasks, reducing the attack surface.

Key Concept

Azure RBAC, Management Groups, and Just-In-Time Access Governance
Rate this question

Topics

Azure RBAC and Subscription Governance