Examkin

Soru

Zorluk: OrtaAzure RBAC and Subscription Governance

An enterprise is implementing a subscription governance strategy. You need to create a custom Azure RBAC role named 'VM Operator' that allows users to manage virtual machines but prevents them from modifying associated virtual networks. The role must be assignable across all subscriptions in a specific Management Group named 'Production-MG'.

Which sequence of steps should you perform to define, create, and assign this custom RBAC role?

  1. 1Retrieve the resource ID of the 'Production-MG' management group.
  2. 2Configure the 'AssignableScopes' property in the custom role definition JSON file to include the management group resource ID.
  3. 3Register the custom role definition in Azure by executing a role creation command referencing the JSON file.
  4. 4Create a role assignment that binds the registered custom role to the target Microsoft Entra ID security group at the scope of 'Production-MG'.

Cevap

The correct sequence starts with retrieving the resource ID of the 'Production-MG' management group, followed by configuring the AssignableScopes property in the custom role definition JSON, registering the custom role in Azure, and finally creating the role assignment for the security group at the management group scope.
To successfully deploy and assign a custom role at the management group scope, you must follow a dependency-aware sequence: first, retrieve the scope's resource ID; second, reference it in the custom role definition's AssignableScopes; third, register the definition in Azure; and fourth, assign the registered role to the target identity group.

Adım Adım Çözüm

1
Retrieve the resource ID of the 'Production-MG' management group.
You obtain the resource path, for example: `/providers/Microsoft.Management/managementGroups/Production-MG`.
Custom roles assigned or scoped to a management group require the exact Resource ID in their definition.
2
Edit the custom role JSON definition file.
The `AssignableScopes` array contains the management group resource ID.
Defining the scope prevents the role from being used outside the designated management group hierarchy.
3
Run the creation command, such as `az role definition create --role-definition <file.json>`.
The custom role is registered and becomes available for assignment in the Azure tenant.
A custom role must exist in the tenant's registry before assignments can be made.
4
Create the role assignment to the target group at the management group scope.
Users in the group receive the specified permissions across all subscriptions in the management group.
Applying the assignment at the management group level ensures policy and access inheritance across all child subscriptions.

Anahtar Kavram

Azure Custom Role Definition and Deployment Workflow
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance