Examkin

All practice questions

14 questions

All types1,198Multiple choice617Multiple select502Matching65Ordering14
Question 1Question →

Arrange the levels of the Azure resource hierarchy in order from the highest scope (broadest access) to the lowest scope (most granular access).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of the Azure resource hierarchy from highest to lowest scope is: Management Groups, Subscriptions, Resource Groups, and Resources.
The correct order from broadest to most granular scope is Management Groups, Subscriptions, Resource Groups, and Resources. This structure governs scope inheritance, where permissions and policies assigned at higher scopes are inherited by lower scopes.

Step-by-Step Solution

1
Identify the broadest administrative boundary used for managing multiple subscriptions.
Management Groups represent the highest level.
Management groups allow you to organize subscriptions and apply governance controls at scale.
2
Identify the billing and management boundary beneath Management Groups.
Subscriptions sit below Management Groups.
Subscriptions group resources together and are associated with a single billing account.
3
Determine the logical container within a subscription.
Resource Groups are positioned beneath Subscriptions.
Resource groups organize resources that share the same lifecycle and deployment cycle.
4
Identify the individual instances of Azure services.
Resources sit at the lowest level of the hierarchy.
Resources are the final deployable units (like VMs or storage accounts) inheriting all access and policies from parent scopes.

Key Concept

Azure Resource Hierarchy and Scope Inheritance
Estimated Time:45s
Question 2Question →

You are designing a subscription governance and delegated administration solution for a new Azure landing zone. The solution must meet the following requirements:
- Establish a new management boundary for a dedicated business unit.
- Implement a custom Azure RBAC role named 'Resource Lock Manager' that allows managing resource locks but prevents deletion of any resources. This role must only be assignable within this new management boundary.
- Ensure that the operations team members can only active this role on-demand to align with the principle of least privilege.
- Use a Microsoft Entra ID group to minimize direct role assignments to individual users.

Which sequence of configuration steps should you perform to implement the solution?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps is: First, create a new Management Group to serve as the management boundary. Second, define the 'Resource Lock Manager' custom Azure RBAC role, setting the 'AssignableScopes' property to the path of the new Management Group. Third, create a Microsoft Entra ID security group with the 'isAssignableToRole' property set to true. Fourth, assign the 'Resource Lock Manager' custom role to the Microsoft Entra ID security group at the new Management Group scope. Fifth, configure Privileged Identity Management (PIM) for Groups on the security group, and assign the operations team members as eligible.
The correct sequence respects the resource and configuration dependencies. The Management Group must be created first to obtain its resource path. The custom role definition references this path in its 'AssignableScopes' property. Next, the target security group must be created. The custom role can then be assigned to the group at the Management Group scope. Finally, PIM for Groups can be configured for the group to delegate eligible membership to the operations team.

Step-by-Step Solution

1
Create the new Management Group.
A new management boundary is established with a unique resource path.
The unique resource ID of the Management Group is a hard dependency for the custom RBAC role's scope definitions.
2
Define the 'Resource Lock Manager' custom Azure RBAC role with the 'AssignableScopes' set to the Management Group.
The custom role is registered and available for assignment within the Management Group hierarchy.
The role definition must exist and target the correct boundary scope before it can be assigned to any security principal.
3
Create a Microsoft Entra ID group with the 'isAssignableToRole' parameter enabled.
A role-assignable Entra ID security group is created.
Using a role-assignable group is a prerequisite for assigning custom Azure RBAC roles and configuring PIM for Groups.
4
Assign the custom RBAC role to the Entra ID group at the Management Group scope.
The group is granted the 'Resource Lock Manager' permissions over all resources in the Management Group scope.
The role assignment must exist at the group level so that users who activate their membership automatically inherit the custom role's permissions.
5
Enable PIM for Groups on the group and configure the operations team members as eligible.
Users can activate group membership on-demand, which dynamically grants them the custom RBAC role.
This prevents permanent assignment of administrative privileges, fulfilling the least-privilege requirement.

Key Concept

Azure RBAC delegation using custom roles, management group scopes, and Entra ID PIM for Groups.
Estimated Time:3m 0s
Question 3Question →

An organization is designing a subscription governance model to allow network security administrators to manage network security rules across multiple subscriptions. To follow the principle of least privilege, the administrators must only be able to elevate their access on-demand using Just-In-Time (JIT) access. You need to configure this administrative model. In which order should you perform the configuration steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To implement this design, first create a parent Management Group and associate the subscriptions. Next, create a custom Azure RBAC role with the required permissions and set its assignable scope to the Management Group. Then, create a Microsoft Entra ID security group and assign the custom role to it at the Management Group scope. Finally, configure PIM for Groups to make users eligible for the security group, enabling JIT access.
Establishing the Management Group first provides the container needed for scope inheritance and is required before configuring custom roles targeting that scope. The custom role must specify the Management Group in its assignable scopes. The security group must be created next so that the custom role can be assigned to it. Assigning the custom role to the group at the Management Group scope ensures the permissions are inherited by all child subscriptions. Finally, configuring PIM for Groups enables Just-In-Time membership, fulfilling the requirement for JIT administrative access.

Step-by-Step Solution

1
Establish the management scope.
A new parent Management Group containing the target subscriptions is created.
This establishes the scope hierarchy and allows governance controls to inherit downward.
2
Define the custom Azure RBAC role.
A custom role definition is registered with the parent Management Group in its AssignableScopes.
Custom roles must define where they can be assigned. The Management Group must exist before it can be referenced in the role definition's assignable scopes.
3
Deploy a Microsoft Entra security group.
A security group exists to hold the network administrators.
Group-based role assignment is a best practice that simplifies PIM integration and minimizes individual role assignments.
4
Bind the custom role to the security group.
The security group is assigned the custom role at the parent Management Group scope.
This configuration ensures that any active member of the security group inherits the custom role permissions across all subscriptions in the Management Group.
5
Enable Privileged Identity Management for the security group.
Administrator accounts are made eligible for the security group in PIM.
This enables Just-In-Time (JIT) membership elevation, satisfying the least privilege and on-demand requirements.

Key Concept

Group-based Azure RBAC scope inheritance combined with Microsoft Entra PIM for Groups to achieve Just-In-Time least privilege management.
Question 4Question →

An enterprise is implementing a subscription governance strategy. You need to create a custom Azure RBAC role named 'VM Operator' that allows users to manage virtual machines but prevents them from modifying associated virtual networks. The role must be assignable across all subscriptions in a specific Management Group named 'Production-MG'.

Which sequence of steps should you perform to define, create, and assign this custom RBAC role?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with retrieving the resource ID of the 'Production-MG' management group, followed by configuring the AssignableScopes property in the custom role definition JSON, registering the custom role in Azure, and finally creating the role assignment for the security group at the management group scope.
To successfully deploy and assign a custom role at the management group scope, you must follow a dependency-aware sequence: first, retrieve the scope's resource ID; second, reference it in the custom role definition's AssignableScopes; third, register the definition in Azure; and fourth, assign the registered role to the target identity group.

Step-by-Step Solution

1
Retrieve the resource ID of the 'Production-MG' management group.
You obtain the resource path, for example: `/providers/Microsoft.Management/managementGroups/Production-MG`.
Custom roles assigned or scoped to a management group require the exact Resource ID in their definition.
2
Edit the custom role JSON definition file.
The `AssignableScopes` array contains the management group resource ID.
Defining the scope prevents the role from being used outside the designated management group hierarchy.
3
Run the creation command, such as `az role definition create --role-definition <file.json>`.
The custom role is registered and becomes available for assignment in the Azure tenant.
A custom role must exist in the tenant's registry before assignments can be made.
4
Create the role assignment to the target group at the management group scope.
Users in the group receive the specified permissions across all subscriptions in the management group.
Applying the assignment at the management group level ensures policy and access inheritance across all child subscriptions.

Key Concept

Azure Custom Role Definition and Deployment Workflow
Question 5Question →

Your company is designing a governance solution for a multi-subscription Azure environment. A security team requires a custom RBAC role named 'Network Security Operator' to manage network security groups (NSGs) across all subscriptions in a specific department. These subscriptions are organized under a single department-level management group. You need to implement the custom role following the principle of least privilege. What is the correct sequence of steps to configure and assign this custom role?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Retrieve the management group resource ID, define the custom role JSON with AssignableScopes set to the management group ID, register the custom role in the tenant, and then assign the role to the Entra ID group at the management group scope.
The correct sequence requires obtaining the management group resource ID first to populate the AssignableScopes property in the JSON file. Next, the JSON file is defined with the necessary network security group actions and the specific assignable scope. After defining the JSON, the custom role is registered in the Azure tenant. Once registered, it is assigned to the security team's Microsoft Entra ID group at the department-level management group scope, enabling least-privilege administrative inheritance across all descendant subscriptions.

Step-by-Step Solution

1
Retrieve the resource ID of the department-level management group.
You obtain the fully qualified Azure Resource Manager ID of the management group.
Custom roles require explicit resource IDs in their AssignableScopes list. The ID is necessary to construct the JSON file.
2
Create a custom role JSON definition with required NSG permissions and set AssignableScopes to the management group's resource ID.
A local JSON file containing the role's permissions and scope restrictions is prepared.
Defining the role's capabilities and assignable boundaries is a prerequisite to registering the role.
3
Register the custom role in the Azure tenant by importing the JSON definition.
The custom role is created and becomes globally visible in the Entra ID tenant.
The role definition must exist in the Azure Resource Manager control plane before any assignments can be made.
4
Assign the registered custom role to the security team's Microsoft Entra ID group at the department-level management group scope.
The group's members inherit the Network Security Operator permissions across all subscriptions in the management group.
Following the principle of least privilege and best practices, permissions are assigned to a group at the highest appropriate hierarchy level (management group) for inheritance.

Key Concept

Azure Custom RBAC Role Lifecycle and Scope Inheritance
Question 6Question →

An organization is establishing a new governance model for their Azure environment. They need to delegate administrative permissions for managing virtual networks to a network operations team while adhering to the principle of least privilege. You need to configure a custom RBAC role and a new Management Group structure. Arrange the steps in the correct order to configure and delegate these permissions, starting with establishing the scope boundary and ending with granting user access.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps is: 1) Create the new Management Group hierarchy, 2) Draft a custom role definition JSON file with the AssignableScopes set to the new Management Group ID, 3) Register the custom RBAC role, 4) Create a Microsoft Entra ID security group, and 5) Create a role assignment mapping the custom RBAC role to the security group at the Management Group scope.
The correct sequence begins by creating the target Management Group hierarchy to establish the scope boundary. This allows the Management Group's resource ID to be included in the AssignableScopes property of the custom role definition. Once drafted, the custom role is registered in Azure. Subsequently, a Microsoft Entra ID security group is created to house the users, adhering to identity management best practices. Finally, the custom role is assigned to the security group at the Management Group scope to delegate the permissions.

Step-by-Step Solution

1
Define the organizational scope boundary.
Management Group hierarchy is created.
The custom role definition requires an existing scope ID for its AssignableScopes property.
2
Define the permissions and scope limits.
Custom role definition JSON is drafted.
Permissions and scopes must be defined in a JSON template before registration.
3
Create the custom role in the tenant.
Custom RBAC role is created in the Azure tenant.
The role must be registered in Azure before it can be assigned to security principals.
4
Define the security principal group.
Microsoft Entra ID security group with members is created.
Assigning roles to groups rather than individual users is an Azure best practice for access management.
5
Assign the custom role to the security principal group.
Role assignment is applied at the Management Group scope.
This links the security principal, the role, and the scope to grant the permissions.

Key Concept

Configuring custom Azure RBAC roles within a Management Group hierarchy
Question 7Question →

Your company has an Azure subscription containing multiple development environments. You need to delegate the management of virtual machines to a development operations team. The team must be able to perform all virtual machine operations except deleting virtual machines. The delegation must follow the principle of least privilege, apply only to the development subscription, and be assigned to a Microsoft Entra ID security group. You decide to create a custom RBAC role to meet these requirements.

In which order should you perform the steps to configure and apply the custom role?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Export the template, modify the JSON file to set actions and assignable scopes, register the custom role in the tenant, and then assign the role to the Entra ID security group at the subscription scope.
To create and apply a custom Azure RBAC role, you must follow a structured lifecycle. First, retrieve a JSON template using an existing role. Second, customize the `Actions`, `NotActions`, and `AssignableScopes` fields inside the JSON to align with least privilege and target scope. Third, register the custom role within the Microsoft Entra tenant using the command `New-AzRoleDefinition`. Finally, assign the registered role to the Microsoft Entra ID security group at the desired subscription scope.

Step-by-Step Solution

1
Run the `Get-AzRoleDefinition` command with the name of a built-in role (e.g., Virtual Machine Contributor) and export the output to a JSON file.
A local JSON file containing the schema of the role definition is created.
Creating a custom role from scratch is error-prone; exporting an existing role definition provides a correctly formatted JSON schema.
2
Open the JSON file and configure `Actions` to include `Microsoft.Compute/virtualMachines/*`, set `NotActions` to include `Microsoft.Compute/virtualMachines/delete`, and configure `AssignableScopes` to target the subscription ID.
The JSON file is populated with correct permissions and scope limitations.
Setting `Actions` and `NotActions` meets the access requirements, and defining the subscription scope prevents the custom role from being assigned at unauthorized scopes.
3
Execute the `New-AzRoleDefinition` command, passing the path to the modified JSON file.
The custom role is registered and becomes available for assignment in the Azure tenant.
Before a custom role can be assigned to security principals, it must be officially registered in the tenant.
4
Assign the custom role to the Microsoft Entra ID security group at the subscription scope using the Azure Portal, CLI, or PowerShell.
Members of the security group receive the specified permissions on the target subscription.
The final step is to assign the registered custom role to the security group to grant active permissions.

Key Concept

Azure Custom Role Lifecycle and Assignment
Question 8Question →

An organization wants to delegate custom permissions to a development team. The team needs the ability to restart and manage virtual machines across all subscriptions nested under the 'R&D' management group. You must design a custom role that permits virtual machine management operations but explicitly prevents virtual network configuration modifications. The custom role must be scope-constrained so it can only be assigned to subscriptions under the 'R&D' management group. You need to create this custom role and assign it to the development team's Microsoft Entra ID group. Which sequence of actions should you perform?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Retrieve the resource ID of the 'R&D' management group, create a JSON definition file containing the custom role's permissions and specifying the management group's resource ID in the AssignableScopes list, register the custom role in the tenant by importing the JSON definition file using the Azure CLI or Azure PowerShell, and finally assign the registered custom role to the development team's Microsoft Entra ID group at the 'R&D' management group scope.
The correct sequence begins with identifying the resource ID of the 'R&D' management group. This ID must be included in the AssignableScopes property of the custom role JSON definition. Once the JSON file is fully configured, the custom role is registered in the Azure Active Directory (Microsoft Entra ID) tenant. Only after the custom role is successfully registered can it be assigned to the target security group at the management group scope.

Step-by-Step Solution

1
Retrieve the resource ID of the 'R&D' management group.
You obtain the precise resource path of the target management group.
The custom role's AssignableScopes property requires the exact resource path of the management group to restrict where the role can be defined and used.
2
Create a JSON definition file detailing permissions and scopes.
A complete JSON role definition document with Actions, NotActions, and AssignableScopes is drafted.
This file establishes the actual configuration of the custom role, ensuring the exclusion of network permissions and target scope restrictions.
3
Import the JSON definition file to register the role.
The custom role definition is registered in the Azure tenant database.
The role must be registered in Azure before Azure Resource Manager can process assignments for it.
4
Assign the custom role to the Microsoft Entra ID group.
The security group is granted the permissions defined in the custom role at the management group scope.
Assigning the role at the management group scope ensures all nested subscriptions inherit the permissions automatically.

Key Concept

Azure Custom RBAC Role Lifecycle and Scope Inheritance
Question 9Question →

An enterprise is designing a subscription governance model to manage resources across multiple departments. You need to implement a management group hierarchy and delegate resource access using a custom Azure RBAC role. The solution must ensure that administrative access is inherited across all department subscriptions and adheres to the principle of least privilege.

Which sequence of steps should you perform?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is to first create the management group hierarchy, associate the departmental subscriptions with their designated management groups, define and create the custom Azure RBAC role specifying the management group paths in the AssignableScopes, create Microsoft Entra ID security groups for the administrative roles, and finally create the role assignments mapping the security groups to the custom role at the management group scope.
Establishing governance begins with defining the resource hierarchy (management groups) and placing subscriptions within that hierarchy. Once the hierarchy is established, the custom role definition is created with AssignableScopes set to the management groups. Then, Microsoft Entra ID security groups are created to hold users, and finally, the custom role is assigned to the security groups at the management group scope to enable inheritance.

Step-by-Step Solution

1
Create the management group hierarchy.
Management groups are available in the tenant.
Establishing the management group structure is required before configuring assignable scopes or assigning permissions at these scopes.
2
Associate subscriptions with the management groups.
Subscriptions are organized under their respective management groups.
This enables inheritance of access controls and policies from the parent management groups down to the subscriptions.
3
Define and create the custom Azure RBAC role.
The custom RBAC role is registered and available for assignment.
The custom role's AssignableScopes must reference the existing management group resource IDs, so the hierarchy must exist first.
4
Create Microsoft Entra ID security groups.
Security groups representing operational roles are populated with users.
Assigning roles to security groups rather than individual users aligns with the principle of least privilege and simplifies management.
5
Assign the custom RBAC role to the security groups.
Role assignments are created at the management group scope.
This completes the delegation of access, ensuring users in the groups inherit the necessary permissions across all subscriptions in the management group.

Key Concept

Azure Management Groups allow logical grouping of subscriptions to apply access control, policies, and compliance settings. Custom RBAC roles require an AssignableScopes property that limits where the role can be assigned, and permissions are inherited from parent scopes (Management Groups) to child scopes (Subscriptions, Resource Groups, and Resources).
Question 10Question →

You are designing the resource hierarchy for a new department in Azure to ensure proper subscription governance. You need to organize the resources from the top-level management structure down to the individual resources in the correct logical order according to Azure's resource hierarchy. Order the steps required to establish this hierarchy and deploy the resources.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps to establish the resource hierarchy and deploy resources is: first, create a child management group under the Tenant Root Group; second, associate an Azure subscription with the management group; third, create a resource group within that subscription; and finally, deploy individual resources into the resource group.
The correct order follows Azure's resource hierarchy from top to bottom: Management Groups, Subscriptions, Resource Groups, and Resources. You start by creating a management group under the Tenant Root Group, then link the subscription to it, create a resource group in that subscription, and finally deploy the resources inside the resource group.

Step-by-Step Solution

1
Create a child management group.
A management group is established under the Tenant Root Group to define organizational governance.
Management groups are the highest level container in the hierarchy below the root and apply policies/RBAC to all child subscriptions.
2
Associate an Azure subscription.
The subscription is placed under the management group.
Subscriptions inherit the governance controls applied to the parent management group and act as billing boundaries.
3
Create a resource group.
A resource group is provisioned within the subscription.
Resources cannot be deployed directly to a subscription; they must reside within a resource group.
4
Deploy individual resources.
Resources are deployed into the resource group.
The resource group is the direct deployment container for Azure resources.

Key Concept

Azure Resource Hierarchy and Governance Scope
Question 11Question →

Your organization has an Azure management group hierarchy consisting of a root management group and several child management groups. You are designing a governance strategy and need to implement a custom Azure RBAC role named 'Billing Reader Custom' for a specific child management group named 'Finance-MG'. The role must be assignable only within 'Finance-MG' and its descendants. You need to create this custom role and assign it to a Microsoft Entra security group named 'Finance Auditors' for a specific subscription under 'Finance-MG'. Which sequence of steps should you perform to create and assign the custom role?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Verify permissions at the management group scope, retrieve the management group resource ID, define the AssignableScopes in the JSON file using the management group ID, register the role using the CLI, and assign it to the security group at the subscription scope.
To create a custom Azure RBAC role scoped to a management group, you must first verify that you have administrative access (such as Owner or User Access Administrator) at that management group scope. You then retrieve the management group's resource ID and place it in the AssignableScopes array of the role definition JSON. Once the JSON file is created, you register the role using the CLI command. Finally, because the subscription inherits the custom role availability from the parent management group, you assign the role to the target group at the subscription scope.

Step-by-Step Solution

1
Ensure that the deploying user account has write permissions for role definitions at the 'Finance-MG' scope.
Confirms the deployment process will not fail due to authorization constraints when registering the custom role.
Creating a custom role with a management group assignable scope requires write permissions (Microsoft.Authorization/roleDefinitions/write) at that specific management group scope.
2
Retrieve the resource ID for the 'Finance-MG' management group.
Acquires the exact resource ID path required for the role definition.
The AssignableScopes list in the custom role definition requires the full resource path format: /providers/Microsoft.Management/managementGroups/Finance-MG.
3
Create a JSON role definition template and set the AssignableScopes property to include the management group resource ID.
Prepares the schema structure for the custom role, limiting its scope strictly to Finance-MG and its child subscriptions.
Setting the AssignableScopes directly restricts where the custom role can be displayed and assigned, preventing leakage to other management group branches.
4
Execute the 'az role definition create' command using the JSON file.
Creates and registers the custom role at the tenant level, making it active for the specified assignable scopes.
The custom role must be registered within the Azure active directory/tenant database before any assignments can be made.
5
Assign the newly created custom role to the 'Finance Auditors' security group at the scope of the target subscription.
Grants the security group billing reader permissions specifically for the target subscription.
Because the subscription resides within the management group hierarchy under 'Finance-MG', it inherits the availability of the custom role, allowing the role assignment to succeed.

Key Concept

Azure Custom RBAC Roles can be scoped to Management Groups, allowing them to be inherited by all child subscriptions and resources, while the creation itself requires appropriate write permissions at that management group level.
Estimated Time:3m 0s
Question 12Question →

An enterprise plans to integrate a newly acquired subsidiary's standalone Azure subscription into its corporate Management Group structure under a single Microsoft Entra tenant.

The corporate architecture team defines the following requirements:
- A custom Azure RBAC role named 'FinancialAuditor' must be created for the subsidiary's audit team.
- The 'FinancialAuditor' role must only be assignable within the '/providers/Microsoft.Management/managementGroups/Corp-Finance-MG' Management Group hierarchy.
- The subsidiary's subscription must be moved under 'Corp-Finance-MG' and inherit all governance controls.
- To maintain security best practices, direct RBAC assignments to individual user accounts are prohibited.

You need to configure the subscription transition and access controls.

Arrange the steps in the correct logical sequence to meet the requirements.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct logical sequence is: first, define the custom role's JSON structure; second, register the custom role in Azure; third, move the subscription under the target Management Group; fourth, create a Microsoft Entra ID security group; and fifth, assign the custom role to the security group at the Management Group scope.
The correct sequence ensures that prerequisites are met step-by-step. First, the JSON definition must specify the assignable scope (the target Management Group) so that the role cannot be assigned outside it. Second, the role definition must be registered in Azure before it can be assigned. Third, the subscription must be moved under the management group so that it inherits the permissions. Fourth, a security group must be created to hold the users (avoiding direct assignments). Finally, the role assignment is created at the Management Group scope, linking the group to the role, which grants the required access to the subscription via inheritance.

Step-by-Step Solution

1
Define the custom role JSON file with correct AssignableScopes.
A custom role template is created that limits the role's assignment boundary to the target Management Group.
Custom roles require explicit assignable scopes to be defined prior to creation.
2
Register the custom role in the Microsoft Entra tenant.
The 'FinancialAuditor' role becomes available in Azure RBAC.
The role definition must exist in the tenant's registry before it can be assigned to users or groups.
3
Move the subscription to the 'Corp-Finance-MG' Management Group.
The subscription is placed under the management group and is subject to its policy and RBAC boundary.
This establishes the target hierarchy needed for inherited permissions and compliance boundary controls.
4
Create a security group in Microsoft Entra ID and populate it.
A security principal representing the audit team is created.
Azure best practice dictates using group-based RBAC assignments rather than direct user assignments to minimize administrative overhead.
5
Assign the custom role to the security group at the Management Group scope.
The group's members receive the defined permissions on the target subscription via inheritance.
Assigning the role at the Management Group scope applies the permissions to all child resources within that hierarchy.

Key Concept

Azure RBAC Custom Role creation, Assignable Scopes validation, Management Group inheritance, and Group-based role assignment.
Question 13Question →

A retail company plans to reorganize its Azure subscription governance. You are designing a strategy to delegate subscription-level billing and resource group management permissions using a custom Azure RBAC role. The custom role must be applied across multiple new subscriptions that will be grouped under a new management group hierarchy. You need to recommend the correct sequence of steps to implement this strategy while ensuring that administrators have immediate, inherited access to the subscriptions as soon as they are governed by the new hierarchy, and that no invalid scope references are created. Which sequence of actions should you recommend?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Create the new management group hierarchy under the Tenant Root Group, define the custom Azure RBAC role specifying the new management group ID in the AssignableScopes property, assign the custom role to the Microsoft Entra ID security group at the management group scope, and then move the targeted Azure subscriptions into the new management group hierarchy.
Establishing the management group hierarchy first is required to obtain a valid resource ID for the custom role's assignable scopes. The custom role must then be defined before it can be assigned. Assigning the custom role at the management group level before moving subscriptions ensures that permissions are immediately inherited, eliminating any window where resources are unmanaged.

Step-by-Step Solution

1
Create the management group hierarchy.
The target Management Group hierarchy is established, producing a valid resource ID scope.
To provide a valid scope for the custom role's AssignableScopes and role assignment.
2
Define the custom role with AssignableScopes set to the management group.
The custom role is registered in Azure RBAC, ready for assignment.
A custom role must exist and target the correct assignable scope before it can be assigned.
3
Create the role assignment at the management group level for the Entra ID security group.
The security group is authorized to perform the role's actions across the entire management group hierarchy.
To ensure permission inheritance is established at the destination scope before resources are introduced.
4
Move the subscriptions into the management group hierarchy.
Subscriptions immediately inherit the custom role permissions.
To govern the subscriptions under the new model without causing administrative gaps.

Key Concept

Subscription governance deployment sequence and RBAC inheritance rules.
Question 14Question →

Your company is designing a delegated administration model for a team of database administrators (DBAs) who manage resources across multiple Azure subscriptions. The DBAs require temporary, time-bound permissions to manage Azure SQL databases within a specific subset of subscriptions, adhering to the principle of least privilege.

You plan to implement a custom Azure RBAC role and delegate it using Microsoft Entra Privileged Identity Management (PIM) for Groups.

Which sequence of steps should you perform to implement this governance solution?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To implement the delegated administration model, first create the management group to define the scope. Next, create the custom Azure RBAC role and set its assignable scope to that management group. Then, create a role-assignable Microsoft Entra security group. Assign the custom role to the group at the management group scope, and finally, configure eligible member assignments for the DBAs to the group in PIM for Groups.
The correct sequence begins by defining the boundary (creating the management group), which allows for the creation of the custom role referencing that specific scope. A role-assignable group is then created to receive the assignment. The custom role is assigned to the group, and finally, Privileged Identity Management (PIM) for Groups is configured to govern membership of that group dynamically, enforcing JIT access.

Step-by-Step Solution

1
Create a new management group and move the target subscriptions under it.
A unified scope is established, which provides a resource path for RBAC scopes.
The resource ID of this management group is a prerequisite for configuring the custom role's assignable scopes.
2
Define a custom Azure RBAC role with the management group in its AssignableScopes.
A custom role is created that can be assigned at the management group scope or below.
Azure RBAC requires that custom roles specify the exact scopes at which they can be assigned.
3
Create a role-assignable security group in Microsoft Entra ID.
An Entra security group with the isAssignableToRole property enabled is created.
Only role-assignable groups can be used reliably for Delegated RBAC assignments and onboarding to PIM for Groups.
4
Assign the custom RBAC role to the security group at the management group scope.
The security group is granted permissions to manage Azure SQL databases across all subscriptions in the management group.
This establishes the permission link to the group before group membership is governed via JIT.
5
Configure eligible member assignments for DBAs in PIM for Groups.
DBAs are set up as eligible members who can activate their membership to assume the role temporarily.
This enforces the principle of least privilege by ensuring access is time-bound and approved.

Key Concept

Azure RBAC scope inheritance, custom role assignable scopes, and Microsoft Entra PIM for Groups governance.
All practice questions — Microsoft Azure Solutions Architect (AZ-305) | Examkin