AZ-500 Question 4
Single answerYou manage a resource group named 'AppRG' that hosts multiple Azure resources. You need to give a developer named DevUser the ability to manage and create resources within AppRG, but ensure that DevUser cannot delete the resource group or modify any RBAC role assignments. Which built-in role assignment would best fulfill this requirement?
- A
Assign the Owner role at the resource group scope to DevUser
- B
Assign the Contributor role at the resource group scope to DevUser
- C
Assign the Contributor role at the subscription scope to DevUser
- D
Assign the Reader role at the resource group scope to DevUser
Show answer and explanation
Correct answer: B
Explanation
To meet the scenario requirements, you want to ensure that DevUser can manage resources within the AppRG resource group but not alter RBAC assignments or delete AppRG itself. According to Azure RBAC documentation, the Contributor role at a specific scope (in this case, the resource group) is the best fit, as it allows resource management without granting higher-level access like managing role assignments (which Owner would). Reference: https://learn.microsoft.com/azure/role-based-access-control/built-in-roles#contributor.
- A. Incorrect.
Option 1: Owner at the resource group level would allow DevUser to manage resources, but it would also enable them to manage access and potentially delete the resource group, which exceeds the requirement.
- B. Correct.
Option 2: Contributor at the resource group level grants DevUser the ability to view, create, modify, and delete resources within AppRG without granting rights to manage RBAC assignments or delete the resource group. This precisely matches the requirement.
- C. Incorrect.
Option 3: Contributor at the subscription level gives DevUser the ability to manage resources across the entire subscription, not just within AppRG. This goes beyond the intended scope.
- D. Incorrect.
Option 4: Reader at the resource group level would only permit DevUser to view resources, not create or modify them. This does not meet the requirement.