A software-as-a-service (SaaS) provider hosts multi-tenant workloads across isolated Azure resource groups within a single subscription. A team of five support engineers needs administrative access to manage database resources only within a specific client's resource group. You must design an access control solution that aligns with the principle of least privilege and Microsoft security best practices.
Which of the following approaches should you recommend to assign these permissions?
- Create a Microsoft Entra ID security group, add the support engineers to this group, and assign the SQL DB Contributor role to the group at the resource group scope.Answer
- BAssign the SQL DB Contributor role directly to each support engineer's individual Microsoft Entra ID user account at the resource group scope.
- CConfigure a Privileged Identity Management (PIM) role assignment that makes the SQL DB Contributor role permanently active for each support engineer's user account at the resource group scope.
- DCreate an Azure Policy with a DeployIfNotExists effect at the subscription level to block database changes by unauthorized users, rather than using Azure RBAC roles.
Answer
Create a Microsoft Entra ID security group, add the support engineers to this group, and assign the SQL DB Contributor role to the group at the resource group scope.
Assigning the SQL DB Contributor role to a Microsoft Entra ID security group at the resource group scope enforces the principle of least privilege and follows scalable governance best practices. This ensures that permissions are scoped only to the specific client's resources and can be managed easily through group membership.
Step-by-Step Solution
Key Concept
Assigning Azure RBAC roles to Microsoft Entra groups at the resource group scope for scalable governance and least privilege access control.