Examkin

Soru

Zorluk: ZorManagement Groups Hierarchies

An organization named Meridian Vanguard configures the following Azure Management Group (MG) hierarchy:

* Tenant Root Group
* Corporate-MG
* Production-MG
* App-Sub-01 (Subscription)
* Development-MG
* Dev-Sub-01 (Subscription)

An administrator named Alice needs to reorganize the environment by moving the subscription App-Sub-01 from Production-MG to Development-MG.

Alice has the following Azure role assignments:
* Owner role on the App-Sub-01 subscription
* Reader role on both Corporate-MG and Production-MG
* Contributor role on Development-MG

What is the outcome when Alice attempts to move the subscription?

  1. A
    The move succeeds because Alice is an Owner on the App-Sub-01 subscription, which grants full control over its parent association.
  2. B
    The move fails because Alice lacks the required write permissions on the target management group (Development-MG).
  3. The move fails because Alice lacks the required write permissions on the source management group (Production-MG).Cevap
  4. D
    The move fails because changing a subscription's parent management group requires the User Access Administrator role at the Tenant Root Group level.

Cevap

The move fails because Alice lacks the required write permissions on the source management group (Production-MG).
To move an Azure subscription to a new parent management group, an administrator must have write permissions at three distinct scopes: the subscription itself, the target management group, and the source management group. While Alice has Owner permissions on the subscription and Contributor permissions on the target (Development-MG), she only has Reader permissions on the source (Production-MG). Because the Reader role does not grant write permissions (specifically Microsoft.Management/managementGroups/subscriptions/write), the operation is blocked.

Adım Adım Çözüm

1
Verify the permission requirements for moving a subscription within a management group hierarchy.
Moving a subscription requires write permissions (Microsoft.Management/managementGroups/subscriptions/write) on both the source and target management groups, as well as write permissions on the subscription itself.
Moving a subscription is an administrative change that modifies the child collections of both management groups and updates the subscription's parent metadata.
2
Evaluate Alice's permissions against the target management group (Development-MG) and the subscription (App-Sub-01).
Alice has Contributor permissions on the target MG (which includes write access) and Owner permissions on the subscription (which includes write access).
These roles satisfy the target-side and resource-side requirements of the move operation.
3
Evaluate Alice's permissions against the source management group (Production-MG).
Alice only has the Reader role on Production-MG, which does not grant write permissions.
Without write permissions on the source management group, Alice cannot authorize the removal of the subscription from that management group, causing the operation to fail.

Anahtar Kavram

Moving subscriptions between management groups requires write permissions at the source management group, the target management group, and on the subscription itself.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Management Groups Hierarchies

Bu konudan daha fazla soru