Examkin

Soru

Zorluk: OrtaAzure RBAC and Subscription Governance

Your company is designing a governance solution for a multi-subscription Azure environment. A security team requires a custom RBAC role named 'Network Security Operator' to manage network security groups (NSGs) across all subscriptions in a specific department. These subscriptions are organized under a single department-level management group. You need to implement the custom role following the principle of least privilege. What is the correct sequence of steps to configure and assign this custom role?

  1. 1Retrieve the resource ID of the department-level management group.
  2. 2Create a custom role JSON definition specifying the network security group permissions and set the AssignableScopes property to the management group's resource ID.
  3. 3Register the custom role in the Azure tenant by importing the JSON definition.
  4. 4Assign the registered custom role to the security team's Microsoft Entra ID group at the department-level management group scope.

Cevap

Retrieve the management group resource ID, define the custom role JSON with AssignableScopes set to the management group ID, register the custom role in the tenant, and then assign the role to the Entra ID group at the management group scope.
The correct sequence requires obtaining the management group resource ID first to populate the AssignableScopes property in the JSON file. Next, the JSON file is defined with the necessary network security group actions and the specific assignable scope. After defining the JSON, the custom role is registered in the Azure tenant. Once registered, it is assigned to the security team's Microsoft Entra ID group at the department-level management group scope, enabling least-privilege administrative inheritance across all descendant subscriptions.

Adım Adım Çözüm

1
Retrieve the resource ID of the department-level management group.
You obtain the fully qualified Azure Resource Manager ID of the management group.
Custom roles require explicit resource IDs in their AssignableScopes list. The ID is necessary to construct the JSON file.
2
Create a custom role JSON definition with required NSG permissions and set AssignableScopes to the management group's resource ID.
A local JSON file containing the role's permissions and scope restrictions is prepared.
Defining the role's capabilities and assignable boundaries is a prerequisite to registering the role.
3
Register the custom role in the Azure tenant by importing the JSON definition.
The custom role is created and becomes globally visible in the Entra ID tenant.
The role definition must exist in the Azure Resource Manager control plane before any assignments can be made.
4
Assign the registered custom role to the security team's Microsoft Entra ID group at the department-level management group scope.
The group's members inherit the Network Security Operator permissions across all subscriptions in the management group.
Following the principle of least privilege and best practices, permissions are assigned to a group at the highest appropriate hierarchy level (management group) for inheritance.

Anahtar Kavram

Azure Custom RBAC Role Lifecycle and Scope Inheritance
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance