AZ-104 Question 26
Single answerYou manage an Azure subscription with multiple resource groups: Development, Test, and Production. You need the Development team to have Contributor permissions only on the Development resource group, the Test team to have Contributor permissions only on the Test resource group, and a Security team to have the ability to manage role assignments at the subscription level. Which role assignments at the appropriate scopes should you configure?
- A
Grant the Development and Test teams the Owner role at the subscription scope, and the Security team the Contributor role at the subscription scope.
- B
Assign the Development and Test teams the Contributor role at their respective resource group scopes, and assign the Security team the User Access Administrator role at the subscription scope.
- C
Give the Development and Test teams the Security Admin role at the subscription scope, and the Security team the Contributor role at the resource group scope.
- D
Assign all teams the Owner role at the resource group scopes they work in, and no role at the subscription scope.
Show answer and explanation
Correct answer: B
Explanation
Roles in Azure can be assigned at different scopes, including subscription, resource group, and resource. By assigning the Contributor role to individual teams at the resource group level, they are limited to managing only those groups’ resources. The Security team needs to manage role assignments across the subscription, so granting them the User Access Administrator role at the subscription scope is the appropriate choice.
- A. Incorrect.
Granting the Dev and Test teams Owner at the subscription level would allow them to manage all resources, including Production, which is not desired.
- B. Correct.
Assigning Contributor to each team at its respective resource group provides limited rights only where needed, and giving the Security team the User Access Administrator role at the subscription level enables them to manage role assignments without giving them full resource access.
- C. Incorrect.
The Security Admin role does not exist as a built-in role for Azure RBAC in this context, and granting Contributor rights at the resource group scope to the Security team would not allow them to manage role assignments at the subscription level.
- D. Incorrect.
Making everyone an Owner at the resource group scope and providing no subscription-level role would prevent the Security team from managing assignments at the subscription scope.