Examkin

Question

Difficulty: HardAzure RBAC and Subscription Governance

A retail company plans to reorganize its Azure subscription governance. You are designing a strategy to delegate subscription-level billing and resource group management permissions using a custom Azure RBAC role. The custom role must be applied across multiple new subscriptions that will be grouped under a new management group hierarchy. You need to recommend the correct sequence of steps to implement this strategy while ensuring that administrators have immediate, inherited access to the subscriptions as soon as they are governed by the new hierarchy, and that no invalid scope references are created. Which sequence of actions should you recommend?

  1. 1Create the new management group hierarchy under the Tenant Root Group.
  2. 2Define the custom Azure RBAC role, specifying the new management group ID in the AssignableScopes property.
  3. 3Assign the custom Azure RBAC role to a Microsoft Entra ID security group at the management group scope.
  4. 4Move the targeted Azure subscriptions into the new management group hierarchy.

Answer

Create the new management group hierarchy under the Tenant Root Group, define the custom Azure RBAC role specifying the new management group ID in the AssignableScopes property, assign the custom role to the Microsoft Entra ID security group at the management group scope, and then move the targeted Azure subscriptions into the new management group hierarchy.
Establishing the management group hierarchy first is required to obtain a valid resource ID for the custom role's assignable scopes. The custom role must then be defined before it can be assigned. Assigning the custom role at the management group level before moving subscriptions ensures that permissions are immediately inherited, eliminating any window where resources are unmanaged.

Step-by-Step Solution

1
Create the management group hierarchy.
The target Management Group hierarchy is established, producing a valid resource ID scope.
To provide a valid scope for the custom role's AssignableScopes and role assignment.
2
Define the custom role with AssignableScopes set to the management group.
The custom role is registered in Azure RBAC, ready for assignment.
A custom role must exist and target the correct assignable scope before it can be assigned.
3
Create the role assignment at the management group level for the Entra ID security group.
The security group is authorized to perform the role's actions across the entire management group hierarchy.
To ensure permission inheritance is established at the destination scope before resources are introduced.
4
Move the subscriptions into the management group hierarchy.
Subscriptions immediately inherit the custom role permissions.
To govern the subscriptions under the new model without causing administrative gaps.

Key Concept

Subscription governance deployment sequence and RBAC inheritance rules.
Rate this question

Topics

Azure RBAC and Subscription Governance