Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

A company is designing the subscription governance structure for its multi-region Azure environment. The environment includes a Production management group that currently contains 15 subscriptions. A centralized operations team requires permissions to start, restart, and monitor virtual machines across all subscriptions within this management group, but they must not be allowed to delete resources or modify virtual machine configurations. The configuration must automatically apply to any new subscriptions added to the Production management group in the future. Additionally, you must ensure that all new virtual machines deployed in these subscriptions are automatically configured with the Azure Monitor agent. Which strategy should you implement to meet the requirements?

  1. Create a custom Azure RBAC role with the specific permissions to start, restart, and monitor virtual machines. Assign this custom role to a Microsoft Entra ID security group containing the operations team, scoped at the Production management group level. Create and assign an Azure Policy definition with the DeployIfNotExists effect to install the Azure Monitor agent on new virtual machines.Answer
  2. B
    Create a custom Azure RBAC role with the specific permissions to start, restart, and monitor virtual machines. Assign this custom role directly to the individual user accounts of the operations team members, scoped at the Production management group level. Create and assign an Azure Policy definition with the DeployIfNotExists effect to install the Azure Monitor agent on new virtual machines.
  3. C
    Configure Microsoft Entra Privileged Identity Management (PIM) to assign the Virtual Machine Contributor role as permanently active to the operations team at the Production management group level. Create and assign an Azure Policy definition with the DeployIfNotExists effect to install the Azure Monitor agent on new virtual machines.
  4. D
    Create a custom Azure RBAC role with the specific permissions to start, restart, and monitor virtual machines. Assign this custom role to a Microsoft Entra ID security group containing the operations team, scoped at the Production management group level. Create and assign an Azure Policy definition with the Deny effect to block the deployment of virtual machines that do not have the Azure Monitor agent configured.

Answer

Create a custom Azure RBAC role with the specific permissions to start, restart, and monitor virtual machines. Assign this custom role to a Microsoft Entra ID security group containing the operations team, scoped at the Production management group level. Create and assign an Azure Policy definition with the DeployIfNotExists effect to install the Azure Monitor agent on new virtual machines.
The correct strategy uses a custom Azure RBAC role assigned to a Microsoft Entra ID security group at the management group level. This enforces the principle of least privilege, manages access efficiently through groups, and ensures that permissions inherit automatically to any new subscriptions. To satisfy the automatic configuration of the Azure Monitor agent on new VMs, an Azure Policy with the DeployIfNotExists effect is required to perform the automatic remediation.

Step-by-Step Solution

1
Define a custom Azure RBAC role with minimal actions required for VM operations.
The operations team is limited to only starting, restarting, and monitoring VMs, fulfilling the least privilege constraint.
Built-in roles like Virtual Machine Contributor allow deletion and modification, which violates the requirement.
2
Create a Microsoft Entra ID security group and assign the custom role at the Production management group scope.
Access is governed at scale and inherits automatically to all existing and future subscriptions inside the management group.
Assigning roles to groups instead of individual users simplifies administration, and scoping at the management group level ensures inheritance to child subscriptions.
3
Create and assign an Azure Policy with the DeployIfNotExists effect at the management group level.
Any new virtual machines deployed within the subscriptions are automatically configured with the Azure Monitor agent.
A DeployIfNotExists policy automatically remediates non-compliant resources by executing a deployment template, whereas a Deny policy would block deployment.

Key Concept

Designing scalable subscription governance, least privilege access control, and automatic resource remediation using Azure RBAC, Management Groups, and Azure Policy.
Rate this question

Topics

Azure RBAC and Subscription Governance