AZ-104 Question 20
Single answerYou are an Azure Administrator for Contoso. A team of developers should be able to create and manage only their own resources within a single resource group, without having access to resources owned by other teams. Which approach should you implement to meet these requirements?
- A
Assign the built-in Contributor role at the subscription level for these developers
- B
Assign the built-in Owner role at the resource group level to each developer
- C
Create a custom RBAC role scoped at the resource group level that grants minimal resource creation and management rights to each developer
- D
Enable just-in-time (JIT) access from Azure Security Center to enforce resource-level isolation for each developer
Show answer and explanation
Correct answer: C
Explanation
To strictly limit what developers can do to only their own resources within a resource group, you must create a custom role with the appropriate permissions and assign it at the correct scope. Built-in roles like Contributor or Owner are too broad and do not provide the granularity needed to limit actions to individual resources within a group.
- A. Incorrect.
This would grant developers full contributor access to all resources in the subscription, which exceeds the requirement and does not isolate access to only a specific resource group.
- B. Incorrect.
Owner role gives full access to the resource group, including permissions to manage roles and access, which is broader than necessary and does not limit them to only their own resources.
- C. Correct.
A custom role allows you to precisely define the permissions for resource creation and management, scoping them to only the developers’ own resources within the resource group while restricting access to resources they do not own.
- D. Incorrect.
Just-in-time (JIT) access is used to provide time-limited privileged access but does not inherently enforce separation of ownership within the same resource group.