SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads

By Microsoft · Question Mode

QuestionQ33

Manage identity, access, and governance

You have an Azure management group named MG1 that includes two subscriptions named Sub1 and Sub2. Both subscriptions are connected to a Microsoft Entra tenant that includes a security group named Group1.

You need to ensure that Group1 members can assign roles to resources in Sub1 and Sub2. The solution must adhere to the principle of least privilege.

Which role should be assigned to Group1?

Explanation

The User Access Administrator role allows management of user access to Azure resources, including assigning Azure RBAC roles. Assigning it at the MG1 management-group scope inherits to both Sub1 and Sub2, while avoiding the unnecessary resource-management permissions granted by Owner. Contributor does not permit Azure RBAC role assignments.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!