AZ-104 Question 25
Select 2You are an Azure Administrator for Contoso. A developer named DevUser must be able to manage resources in the 'DevRG' resource group, but also needs read access to the entire subscription. You want to meet these requirements while adhering to the principle of least privilege. Which two actions should you take?
- A
Assign the Contributor role at the subscription scope for DevUser
- B
Assign the Reader role at the subscription scope for DevUser
- C
Assign the Owner role at the DevRG resource group scope for DevUser
- D
Assign the Contributor role at the DevRG resource group scope for DevUser
- E
Create a custom role granting both read and write permissions at the subscription scope
Show answer and explanation
Correct answers: B, D
Explanation
Reader at the subscription scope ensures the developer can view all resources organization-wide, while Contributor at the DevRG resource group scope gives them the necessary permissions to create and manage resources in that specific group. This approach follows the principle of least privilege by granting only the permissions needed at each scope.
- A. Incorrect.
Assigning the Contributor role at the subscription scope grants DevUser more privileges than needed at the subscription level, violating the principle of least privilege.
- B. Correct.
Assigning the Reader role at the subscription scope enables DevUser to view and monitor resources across the entire subscription without the ability to modify them, which aligns with the requirement for read-only access.
- C. Incorrect.
Assigning the Owner role at the resource group provides full control, including permission management, which exceeds the developer’s requirement for just creating and managing resources.
- D. Correct.
Assigning the Contributor role at the resource group scope allows DevUser to create and manage resources only within 'DevRG', aligning with the specified requirement for resource creation and management.
- E. Incorrect.
Creating a custom role granting wide privileges at the subscription scope is not the least-privilege approach and is more complex than necessary.