AZ-104 Question 27
Single answerYour organization has multiple resource groups within a single subscription. You have a user who needs to fully manage resources in only one specific resource group but must not alter resources outside that group. Which of the following is the most appropriate approach to achieve this requirement?
- A
Assign the Owner role at the subscription scope
- B
Assign the Contributor role at the subscription scope
- C
Assign the Contributor role at the resource group scope
- D
Assign the Reader role at the resource group scope
Show answer and explanation
Correct answer: C
Explanation
By assigning the Contributor role at the resource group scope, you ensure that the user can manage resources in that specific group without being able to modify or access resources outside of it, thus adhering to the principle of least privilege.
- A. Incorrect.
Owner at the subscription scope would give the user full control across all resources in the entire subscription, which exceeds the requirement.
- B. Incorrect.
Contributor at the subscription scope still grants permissions to manage all resources within the subscription, going beyond a single resource group.
- C. Correct.
Contributor at the resource group scope restricts the user's access to managing resources only within the specific resource group, aligning with the requirement.
- D. Incorrect.
Reader at the resource group scope would allow the user to view resources but not manage or modify them, which does not meet the management requirement.