AZ-104 Question 28
Select 2You are managing an Azure subscription with multiple resource groups. A user named John has been assigned the Reader role at the subscription scope and the Contributor role for a specific resource group named RG-Production. Which statements about John’s effective permissions are correct?
- A
He can create and manage resources within RG-Production.
- B
He can assign roles to other users or groups within RG-Production.
- C
He is limited to read-only access for RG-Production because the subscription-level role overrides the resource group assignment.
- D
He has read-only access to resource groups other than RG-Production in the subscription.
Show answer and explanation
Correct answers: A, D
Explanation
John’s highest effective permission at the resource group level is Contributor, which allows him to manage resources in RG-Production. At the subscription level, he holds only the Reader role, so he cannot create or modify resources in other resource groups.
- A. Correct.
Because John has the Contributor role at the resource group level, he can create and manage resources within RG-Production.
- B. Incorrect.
Contributor role does not allow managing role assignments; this requires either Owner or User Access Administrator role.
- C. Incorrect.
Role inheritance is cumulative, higher-level scopes do not override lower-level assignments but combine permissions. The Contributor role grants more privileges than Reader for RG-Production.
- D. Correct.
At the subscription level, John has the Reader role, so he can only view resources in other resource groups, not create or modify them.