Examkin

Soru

Zorluk: ZorAzure RBAC and Subscription Governance

You are designing a subscription governance and delegated administration solution for a new Azure landing zone. The solution must meet the following requirements:
- Establish a new management boundary for a dedicated business unit.
- Implement a custom Azure RBAC role named 'Resource Lock Manager' that allows managing resource locks but prevents deletion of any resources. This role must only be assignable within this new management boundary.
- Ensure that the operations team members can only active this role on-demand to align with the principle of least privilege.
- Use a Microsoft Entra ID group to minimize direct role assignments to individual users.

Which sequence of configuration steps should you perform to implement the solution?

  1. 1Create a new Management Group to serve as the management boundary.
  2. 2Define the 'Resource Lock Manager' custom Azure RBAC role, setting the 'AssignableScopes' property to the path of the new Management Group.
  3. 3Create a Microsoft Entra ID security group with the 'isAssignableToRole' property set to true.
  4. 4Assign the 'Resource Lock Manager' custom role to the Microsoft Entra ID security group at the new Management Group scope.
  5. 5Configure Privileged Identity Management (PIM) for Groups on the security group, and assign the operations team members as eligible.

Cevap

The correct sequence of steps is: First, create a new Management Group to serve as the management boundary. Second, define the 'Resource Lock Manager' custom Azure RBAC role, setting the 'AssignableScopes' property to the path of the new Management Group. Third, create a Microsoft Entra ID security group with the 'isAssignableToRole' property set to true. Fourth, assign the 'Resource Lock Manager' custom role to the Microsoft Entra ID security group at the new Management Group scope. Fifth, configure Privileged Identity Management (PIM) for Groups on the security group, and assign the operations team members as eligible.
The correct sequence respects the resource and configuration dependencies. The Management Group must be created first to obtain its resource path. The custom role definition references this path in its 'AssignableScopes' property. Next, the target security group must be created. The custom role can then be assigned to the group at the Management Group scope. Finally, PIM for Groups can be configured for the group to delegate eligible membership to the operations team.

Adım Adım Çözüm

1
Create the new Management Group.
A new management boundary is established with a unique resource path.
The unique resource ID of the Management Group is a hard dependency for the custom RBAC role's scope definitions.
2
Define the 'Resource Lock Manager' custom Azure RBAC role with the 'AssignableScopes' set to the Management Group.
The custom role is registered and available for assignment within the Management Group hierarchy.
The role definition must exist and target the correct boundary scope before it can be assigned to any security principal.
3
Create a Microsoft Entra ID group with the 'isAssignableToRole' parameter enabled.
A role-assignable Entra ID security group is created.
Using a role-assignable group is a prerequisite for assigning custom Azure RBAC roles and configuring PIM for Groups.
4
Assign the custom RBAC role to the Entra ID group at the Management Group scope.
The group is granted the 'Resource Lock Manager' permissions over all resources in the Management Group scope.
The role assignment must exist at the group level so that users who activate their membership automatically inherit the custom role's permissions.
5
Enable PIM for Groups on the group and configure the operations team members as eligible.
Users can activate group membership on-demand, which dynamically grants them the custom RBAC role.
This prevents permanent assignment of administrative privileges, fulfilling the least-privilege requirement.

Anahtar Kavram

Azure RBAC delegation using custom roles, management group scopes, and Entra ID PIM for Groups.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance