Your organization has ten Azure subscriptions organized under a single management group. A new team of security auditors needs to inspect the configuration of all resources across all ten subscriptions. You must design an access control solution that minimizes administrative overhead, adheres to the principle of least privilege, and ensures scalability.
Which approach should you recommend?
- AAssign the Reader role directly to each auditor's individual user account at the management group scope.
- BConfigure Privileged Identity Management (PIM) to make the Reader role permanently active for the auditors' group at the management group scope.
- Create a Microsoft Entra ID group containing all security auditors, and assign the Reader role to this group at the management group scope.Cevap
- DCreate an Azure Policy with a Deny effect at the management group scope to block write actions, and assign the Owner role to the auditors' group.
Cevap
Create a Microsoft Entra ID group containing all security auditors, and assign the Reader role to this group at the management group scope.
The correct option is to create a Microsoft Entra ID group containing all security auditors and assign the Reader role to this group at the management group scope. This ensures that the permissions inherit down to all ten subscriptions under the management group, provides only the necessary read permissions, and simplifies identity management by assigning the role to a group rather than to individual users.
Adım Adım Çözüm
Anahtar Kavram
Azure RBAC Inheritance and Group-based Access Control
Tahmini Süre:1m 0s