Examkin

Soru

Zorluk: ZorAzure RBAC and Subscription Governance

An enterprise plans to integrate a newly acquired subsidiary's standalone Azure subscription into its corporate Management Group structure under a single Microsoft Entra tenant.

The corporate architecture team defines the following requirements:
- A custom Azure RBAC role named 'FinancialAuditor' must be created for the subsidiary's audit team.
- The 'FinancialAuditor' role must only be assignable within the '/providers/Microsoft.Management/managementGroups/Corp-Finance-MG' Management Group hierarchy.
- The subsidiary's subscription must be moved under 'Corp-Finance-MG' and inherit all governance controls.
- To maintain security best practices, direct RBAC assignments to individual user accounts are prohibited.

You need to configure the subscription transition and access controls.

Arrange the steps in the correct logical sequence to meet the requirements.

  1. 1Define the 'FinancialAuditor' custom role in a JSON file, setting the AssignableScopes property to '/providers/Microsoft.Management/managementGroups/Corp-Finance-MG'.
  2. 2Register the custom role definition in the Azure tenant using the defined JSON file.
  3. 3Move the subsidiary's subscription under the 'Corp-Finance-MG' Management Group.
  4. 4Create a Microsoft Entra ID security group and add the subsidiary's audit team members to it.
  5. 5Assign the 'FinancialAuditor' custom role to the Microsoft Entra ID security group at the 'Corp-Finance-MG' scope.

Cevap

The correct logical sequence is: first, define the custom role's JSON structure; second, register the custom role in Azure; third, move the subscription under the target Management Group; fourth, create a Microsoft Entra ID security group; and fifth, assign the custom role to the security group at the Management Group scope.
The correct sequence ensures that prerequisites are met step-by-step. First, the JSON definition must specify the assignable scope (the target Management Group) so that the role cannot be assigned outside it. Second, the role definition must be registered in Azure before it can be assigned. Third, the subscription must be moved under the management group so that it inherits the permissions. Fourth, a security group must be created to hold the users (avoiding direct assignments). Finally, the role assignment is created at the Management Group scope, linking the group to the role, which grants the required access to the subscription via inheritance.

Adım Adım Çözüm

1
Define the custom role JSON file with correct AssignableScopes.
A custom role template is created that limits the role's assignment boundary to the target Management Group.
Custom roles require explicit assignable scopes to be defined prior to creation.
2
Register the custom role in the Microsoft Entra tenant.
The 'FinancialAuditor' role becomes available in Azure RBAC.
The role definition must exist in the tenant's registry before it can be assigned to users or groups.
3
Move the subscription to the 'Corp-Finance-MG' Management Group.
The subscription is placed under the management group and is subject to its policy and RBAC boundary.
This establishes the target hierarchy needed for inherited permissions and compliance boundary controls.
4
Create a security group in Microsoft Entra ID and populate it.
A security principal representing the audit team is created.
Azure best practice dictates using group-based RBAC assignments rather than direct user assignments to minimize administrative overhead.
5
Assign the custom role to the security group at the Management Group scope.
The group's members receive the defined permissions on the target subscription via inheritance.
Assigning the role at the Management Group scope applies the permissions to all child resources within that hierarchy.

Anahtar Kavram

Azure RBAC Custom Role creation, Assignable Scopes validation, Management Group inheritance, and Group-based role assignment.
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance