AZ-305 Question 29
Select 2Your organization has multiple Azure subscriptions organized under a single management group. You need to ensure that a specific security group of administrators can manage resources in all subscriptions without having to configure each subscription individually. However, you also want to require just-in-time elevation for resource management in the production subscription to follow the principle of least privilege. Which two actions should you recommend?
- A
Assign the built-in Owner role directly at each subscription level for all members of the security group.
- B
Create a custom RBAC role at the tenant root group level and grant it to the security group globally.
- C
Use the management group above all subscriptions to assign a built-in role to the security group, ensuring consistent permissions across subscriptions.
- D
Configure Azure AD Privileged Identity Management (PIM) for the production subscription to enforce just-in-time access for elevated tasks.
Show answer and explanation
Correct answers: C, D
Explanation
By assigning roles at the management group level (Option 3), you can centralize and standardize access for your administrators across all subscriptions in the hierarchy. This simplifies governance and avoids repetitive manual assignments. Additionally, implementing Azure AD Privileged Identity Management (Option 4) for critical environments like production enforces time-bound elevations of privilege, minimizing security risks and aligning with best practices documented in Microsoft’s Privileged Identity Management guidance (https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure).
- A. Incorrect.
Option 1 is incorrect. Assigning the built-in Owner role at each subscription level introduces overhead and risks over-privileging the security group. It does not scale well, especially when new subscriptions are created.
- B. Incorrect.
Option 2 is incorrect. While custom RBAC roles can be useful, assigning them at the tenant root group level could blanket all subscriptions with permissions that might exceed what is necessary, especially if your requirement focuses on least privilege.
- C. Correct.
Option 3 is correct. Assigning a built-in role (e.g., Contributor) at the management group level ensures consistent permissions across all subscriptions while reducing setup and maintenance overhead.
- D. Correct.
Option 4 is correct. Enabling Azure AD PIM for the production subscription allows you to enforce just-in-time role activation, which helps adhere to the principle of least privilege for tasks in production.