Examkin

Question

Difficulty: Very hardAzure RBAC and Subscription Governance

An enterprise manages its resources using a multi-level Azure management group hierarchy under a single Microsoft Entra tenant:

* Root Management Group
* Corporate (Management Group)
* Production (Management Group)
* Subscription-A
* Subscription-B
* Non-Production (Management Group)
* Subscription-C

You are designing a security and governance solution for a group of database administrators (DBAs). The solution must meet the following requirements:
1. The DBAs must be able to create, modify, and delete Azure SQL databases and SQL elastic pools across all subscriptions under the Production management group.
2. The DBAs must be able to view Azure SQL Server configurations but must not be able to create or delete SQL Servers, nor modify database firewall rules or virtual network rules.
3. The solution must minimize administrative overhead and enforce the principles of least privilege and scalable identity governance.

Which design should you recommend?

  1. Create a Microsoft Entra ID security group named DBA-Production-Group. Define a custom Azure RBAC role with Actions set to ["Microsoft.Sql/servers/read", "Microsoft.Sql/servers/databases/*", "Microsoft.Sql/servers/elasticPools/*"] and NotActions set to []. Assign the custom role to the DBA-Production-Group at the scope of the Production management group.Answer
  2. B
    Assign the built-in SQL DB Contributor role directly to each DBA's Microsoft Entra ID user account at the scope of the Production management group.
  3. C
    Create a Microsoft Entra ID security group named DBA-Production-Group. Define a custom Azure RBAC role with Actions set to ["Microsoft.Sql/servers/*"] and NotActions set to ["Microsoft.Sql/servers/delete", "Microsoft.Sql/servers/firewallRules/*"]. Assign the custom role to the DBA-Production-Group at the scope of the Production management group, and configure the assignments as permanently active in Microsoft Entra Privileged Identity Management (PIM).
  4. D
    Create a Microsoft Entra ID security group named DBA-Production-Group. Assign the built-in Contributor role to the group at the Production management group scope. Deploy an Azure Policy at the Production management group scope with a DeployIfNotExists effect to block the creation or deletion of SQL Servers and any modifications to database firewall rules.

Answer

Create a Microsoft Entra ID security group named DBA-Production-Group. Define a custom Azure RBAC role with Actions set to ["Microsoft.Sql/servers/read", "Microsoft.Sql/servers/databases/*", "Microsoft.Sql/servers/elasticPools/*"] and NotActions set to []. Assign the custom role to the DBA-Production-Group at the scope of the Production management group.
The correct approach creates an Entra ID security group to adhere to scalable identity governance. It defines a custom RBAC role that explicitly lists the required actions (reading SQL Server configurations, and full access on databases and elastic pools). Because the custom role does not include write or delete operations on servers, or access to firewall/network sub-resources, those capabilities are restricted by default. Assigning this custom role at the Production management group scope ensures that permissions inherit automatically to all underlying subscriptions, minimizing administration.

Step-by-Step Solution

1
Analyze the scope and governance requirements.
Identify that the DBAs require access to all subscriptions under the Production management group (Subscription-A and Subscription-B). Defining the assignment at the Production management group scope ensures inheritance, minimizing administrative overhead.
Azure RBAC assignments inherit down the resource hierarchy from management groups to subscriptions and resource groups.
2
Determine the identity structure.
Create a Microsoft Entra ID security group (DBA-Production-Group) and assign roles to the group rather than individual users.
Assigning RBAC roles to groups instead of individual accounts is a critical best practice for scalable identity governance.
3
Define the custom role permissions.
Define Actions as ["Microsoft.Sql/servers/read", "Microsoft.Sql/servers/databases/*", "Microsoft.Sql/servers/elasticPools/*"] and NotActions as [].
By explicitly granting only the necessary permissions, the role implicitly denies unauthorized actions (such as server creation, deletion, or firewall modification) without relying on broad wildcards or complex NotActions.

Key Concept

Azure RBAC Custom Roles and Scope Inheritance
Rate this question

Topics

Azure RBAC and Subscription Governance