A financial services company is setting up a new multi-subscription environment in Azure. The compliance team requires that a security group of external security auditors be granted read-only access to verify resource configurations across all current and future subscriptions. The company must enforce the principle of least privilege and ensure that when auditors join or leave the audit team, their access is automatically updated without requiring manual modifications to the Azure role assignments. Which of the following approaches should you recommend?
- ACreate a Microsoft Entra ID group for the auditors and configure a Microsoft Entra Privileged Identity Management (PIM) role assignment as permanently active for the group.
- BAssign the Reader role directly to each auditor's individual Microsoft Entra ID user account at the management group level.
- CDeploy an Azure Policy with a Deny effect to prevent write operations on all resources, and assign the Owner role to the auditors' security group.
- Create a Microsoft Entra ID security group for the auditors and assign the Reader role to the group at the parent management group level.Cevap
Cevap
Create a Microsoft Entra ID security group for the auditors and assign the Reader role to the group at the parent management group level.
The correct option provides read-only access (Reader role) aligned with least privilege, utilizes a security group for efficient onboarding and offboarding, and assigns it at the management group level so that all current and future subscriptions inherit the configuration automatically.
Adım Adım Çözüm
Anahtar Kavram
Azure RBAC Inheritance and Group-based Access Control