Your company has an Azure environment with a subscription named Sub1. Inside Sub1, there is a resource group named RG-Dev that contains several virtual machines.
You need to grant a user named User1 the permission to restart the virtual machines and to delegate role assignments to other team members within RG-Dev. The solution must use the principle of least privilege.
Which two of the following role assignments should you configure? (Select two.)
- Assign the Virtual Machine Contributor role to User1 at the RG-Dev scope.Cevap
- Assign the User Access Administrator role to User1 at the RG-Dev scope.Cevap
- CAssign the Global Administrator role to User1 in Microsoft Entra ID.
- DAssign the User Access Administrator role to User1 at an Administrative Unit scope.
Cevap
To meet the requirements, you must assign the Virtual Machine Contributor role to User1 at the RG-Dev scope to allow virtual machine management, and assign the User Access Administrator role to User1 at the RG-Dev scope to allow delegating role assignments.
To satisfy the requirements, two roles must be assigned at the resource group level: Virtual Machine Contributor (to manage the virtual machines) and User Access Administrator (to delegate role assignments to other users). These roles represent the least privilege configuration required for the scenario.
Adım Adım Çözüm
Anahtar Kavram
Azure RBAC roles are scoped to specific resource hierarchies (Management Group, Subscription, Resource Group, Resource). Assigning Virtual Machine Contributor allows VM management, while User Access Administrator allows role delegation. Microsoft Entra ID directory roles and Administrative Units do not directly grant Azure resource permissions.