Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

An organization is establishing a new governance model for their Azure environment. They need to delegate administrative permissions for managing virtual networks to a network operations team while adhering to the principle of least privilege. You need to configure a custom RBAC role and a new Management Group structure. Arrange the steps in the correct order to configure and delegate these permissions, starting with establishing the scope boundary and ending with granting user access.

  1. 1Create the new Management Group hierarchy to define the organizational scope boundary.
  2. 2Draft a custom role definition JSON file containing the network operations actions and set the AssignableScopes to the new Management Group ID.
  3. 3Register the custom RBAC role in the Azure tenant using the drafted definition file.
  4. 4Create a Microsoft Entra ID security group and add the network operations team members to it.
  5. 5Create a role assignment mapping the custom RBAC role to the security group at the scope of the new Management Group.

Answer

The correct order of steps is: 1) Create the new Management Group hierarchy, 2) Draft a custom role definition JSON file with the AssignableScopes set to the new Management Group ID, 3) Register the custom RBAC role, 4) Create a Microsoft Entra ID security group, and 5) Create a role assignment mapping the custom RBAC role to the security group at the Management Group scope.
The correct sequence begins by creating the target Management Group hierarchy to establish the scope boundary. This allows the Management Group's resource ID to be included in the AssignableScopes property of the custom role definition. Once drafted, the custom role is registered in Azure. Subsequently, a Microsoft Entra ID security group is created to house the users, adhering to identity management best practices. Finally, the custom role is assigned to the security group at the Management Group scope to delegate the permissions.

Step-by-Step Solution

1
Define the organizational scope boundary.
Management Group hierarchy is created.
The custom role definition requires an existing scope ID for its AssignableScopes property.
2
Define the permissions and scope limits.
Custom role definition JSON is drafted.
Permissions and scopes must be defined in a JSON template before registration.
3
Create the custom role in the tenant.
Custom RBAC role is created in the Azure tenant.
The role must be registered in Azure before it can be assigned to security principals.
4
Define the security principal group.
Microsoft Entra ID security group with members is created.
Assigning roles to groups rather than individual users is an Azure best practice for access management.
5
Assign the custom role to the security principal group.
Role assignment is applied at the Management Group scope.
This links the security principal, the role, and the scope to grant the permissions.

Key Concept

Configuring custom Azure RBAC roles within a Management Group hierarchy
Rate this question

Topics

Azure RBAC and Subscription Governance