Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

A media streaming company is structuring its Azure environment to support multiple independent engineering teams. Each engineering team has a separate Azure subscription under a single Management Group. You need to design a governance structure that allows a central auditing team to inspect resource configurations across all subscriptions, without granting them permissions to modify any resources or view secrets and keys. The auditing team's membership changes frequently. Which of the following solutions should you recommend to meet these requirements while minimizing administrative overhead?

  1. A
    Assign the Reader role to each auditing team member's user account individually at the Management Group scope.
  2. B
    Configure Microsoft Entra Privileged Identity Management (PIM) to assign the Reader role as permanently active for each individual auditor's account at the subscription scope.
  3. Create a Microsoft Entra ID security group, add the auditing team members to the group, and assign the Reader role to the group at the Management Group scope.Answer
  4. D
    Implement an Azure Policy with a Deny effect at the Management Group scope to block modifications, and assign the Owner role to the auditors' security group.

Answer

Create a Microsoft Entra ID security group, add the auditing team members to the group, and assign the Reader role to the group at the Management Group scope.
The correct solution uses a Microsoft Entra ID security group to aggregate user accounts, which simplifies access management since membership updates in Entra ID automatically reflect in permissions. Assigning the Reader role at the Management Group scope utilizes Azure's inheritance model to apply the permission across all child subscriptions automatically, fulfilling the requirement for read-only access without access to secrets or modification rights.

Step-by-Step Solution

1
Determine the scope of the role assignment.
Using the Management Group scope ensures that permissions are inherited by all subscriptions nested under it, eliminating the need to assign roles at each subscription individually.
Reduces administrative overhead for multi-subscription environments.
2
Select the appropriate identity principal type.
Group-based assignment is chosen over individual user assignment.
Allows managing membership changes directly in Microsoft Entra ID without modifying Azure RBAC role assignments.
3
Identify the minimum required built-in role.
The Reader role is selected.
Grants read-only access to view resources but does not allow viewing secrets/keys (unlike Reader and Data Access) or modifying resources, adhering to the principle of least privilege.

Key Concept

Azure Management Group Scope and Group-Based RBAC Assignment
Rate this question

Topics

Azure RBAC and Subscription Governance