A retail company plans to reorganize its Azure subscription governance. You are designing a strategy to delegate subscription-level billing and resource group management permissions using a custom Azure RBAC role. The custom role must be applied across multiple new subscriptions that will be grouped under a new management group hierarchy. You need to recommend the correct sequence of steps to implement this strategy while ensuring that administrators have immediate, inherited access to the subscriptions as soon as they are governed by the new hierarchy, and that no invalid scope references are created. Which sequence of actions should you recommend?
- 1Create the new management group hierarchy under the Tenant Root Group.
- 2Define the custom Azure RBAC role, specifying the new management group ID in the AssignableScopes property.
- 3Assign the custom Azure RBAC role to a Microsoft Entra ID security group at the management group scope.
- 4Move the targeted Azure subscriptions into the new management group hierarchy.
Cevap
Create the new management group hierarchy under the Tenant Root Group, define the custom Azure RBAC role specifying the new management group ID in the AssignableScopes property, assign the custom role to the Microsoft Entra ID security group at the management group scope, and then move the targeted Azure subscriptions into the new management group hierarchy.
Establishing the management group hierarchy first is required to obtain a valid resource ID for the custom role's assignable scopes. The custom role must then be defined before it can be assigned. Assigning the custom role at the management group level before moving subscriptions ensures that permissions are immediately inherited, eliminating any window where resources are unmanaged.
Adım Adım Çözüm
Anahtar Kavram
Subscription governance deployment sequence and RBAC inheritance rules.