Examkin

Soru

Zorluk: Çok zorAzure RBAC and Subscription Governance

Your organization has an Azure management group hierarchy consisting of a root management group and several child management groups. You are designing a governance strategy and need to implement a custom Azure RBAC role named 'Billing Reader Custom' for a specific child management group named 'Finance-MG'. The role must be assignable only within 'Finance-MG' and its descendants. You need to create this custom role and assign it to a Microsoft Entra security group named 'Finance Auditors' for a specific subscription under 'Finance-MG'. Which sequence of steps should you perform to create and assign the custom role?

  1. 1Verify that your account has the Owner or User Access Administrator role at the 'Finance-MG' scope.
  2. 2Retrieve the resource ID for the 'Finance-MG' management group.
  3. 3Create a JSON role definition file, setting the AssignableScopes property to include the 'Finance-MG' resource ID.
  4. 4Register the custom role definition by executing the 'az role definition create' command.
  5. 5Assign the custom role to the 'Finance Auditors' security group at the scope of the target subscription.

Cevap

Verify permissions at the management group scope, retrieve the management group resource ID, define the AssignableScopes in the JSON file using the management group ID, register the role using the CLI, and assign it to the security group at the subscription scope.
To create a custom Azure RBAC role scoped to a management group, you must first verify that you have administrative access (such as Owner or User Access Administrator) at that management group scope. You then retrieve the management group's resource ID and place it in the AssignableScopes array of the role definition JSON. Once the JSON file is created, you register the role using the CLI command. Finally, because the subscription inherits the custom role availability from the parent management group, you assign the role to the target group at the subscription scope.

Adım Adım Çözüm

1
Ensure that the deploying user account has write permissions for role definitions at the 'Finance-MG' scope.
Confirms the deployment process will not fail due to authorization constraints when registering the custom role.
Creating a custom role with a management group assignable scope requires write permissions (Microsoft.Authorization/roleDefinitions/write) at that specific management group scope.
2
Retrieve the resource ID for the 'Finance-MG' management group.
Acquires the exact resource ID path required for the role definition.
The AssignableScopes list in the custom role definition requires the full resource path format: /providers/Microsoft.Management/managementGroups/Finance-MG.
3
Create a JSON role definition template and set the AssignableScopes property to include the management group resource ID.
Prepares the schema structure for the custom role, limiting its scope strictly to Finance-MG and its child subscriptions.
Setting the AssignableScopes directly restricts where the custom role can be displayed and assigned, preventing leakage to other management group branches.
4
Execute the 'az role definition create' command using the JSON file.
Creates and registers the custom role at the tenant level, making it active for the specified assignable scopes.
The custom role must be registered within the Azure active directory/tenant database before any assignments can be made.
5
Assign the newly created custom role to the 'Finance Auditors' security group at the scope of the target subscription.
Grants the security group billing reader permissions specifically for the target subscription.
Because the subscription resides within the management group hierarchy under 'Finance-MG', it inherits the availability of the custom role, allowing the role assignment to succeed.

Anahtar Kavram

Azure Custom RBAC Roles can be scoped to Management Groups, allowing them to be inherited by all child subscriptions and resources, while the creation itself requires appropriate write permissions at that management group level.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance