AZ-305 Question 30
Single answerYour company hosts several mission-critical web applications on Azure App Service. Three different development teams need to manage and deploy updates to their respective apps, but each team should only have access to its own resources and no other application in the same subscription. You want to assign permissions following the principle of least privilege while minimizing administrative overhead. Which solution should you recommend?
- A
Create separate Azure AD tenants for each development team and move each app into a different tenant.
- B
Use Azure Role-Based Access Control (RBAC) at the Resource Group level by assigning built-in roles to each development team for their respective App Services.
- C
Assign the Co-Administrator role in the subscription to each development team so they can manage all App Services.
- D
Embed shared credentials for an Azure AD service principal in the application code for each team.
Show answer and explanation
Correct answer: B
Explanation
Using Azure Role-Based Access Control (RBAC) at the Resource Group scope is a recommended best practice for authorizing access to Azure resources. By grouping each application in its own resource group, you can assign the appropriate built-in roles to each development team, ensuring they can only manage their own application while minimizing administrative overhead. Refer to Microsoft’s official documentation (https://learn.microsoft.com/azure/role-based-access-control/overview) for detailed guidance on implementing RBAC to follow the principle of least privilege.
- A. Incorrect.
Incorrect. Creating separate Azure AD tenants for each development team introduces significant overhead and complexity, including tenant-level administration, user synchronization, and identity management. This also complicates collaboration across teams and services in the same subscription, which is not an efficient or recommended approach.
- B. Correct.
Correct. Azure RBAC allows you to assign granular built-in roles (such as Contributor for managing resources or Reader for read-only access) at the Resource Group level. By grouping each web application in its own resource group, you can assign the appropriate role to each development team for their respective resource group, keeping authorization scopes limited and following the principle of least privilege.
- C. Incorrect.
Incorrect. Assigning Co-Administrator role at the subscription level grants too many permissions to all resources in the subscription, violating the principle of least privilege. This makes it easy to inadvertently modify or delete other teams’ resources and is not recommended for production environments.
- D. Incorrect.
Incorrect. Embedding credentials directly in application code is a poor security practice and does not leverage Azure’s built-in identity and access management features. It also complicates rotation of secrets and can lead to unauthorized access if the code is exposed.