AZ-500 Question 5
Single answerYou are a security engineer for a company that wants to delegate the ability to manage role assignments for a specific resource group to its InfoSec team. The InfoSec team must not have permissions to create, modify, or delete any resources within that resource group. Which Azure built-in role should you assign to meet this requirement?
- A
Owner
- B
User Access Administrator
- C
Contributor
- D
Reader
Show answer and explanation
Correct answer: B
Explanation
When you want a group or user to manage role assignments (i.e., grant or revoke permissions) without granting other privileges within an Azure resource group, you should use the User Access Administrator built-in role. This matches the least-privilege principle, providing only the capability to control access. For more information, see the Microsoft documentation on built-in roles for role-based access control (RBAC): https://learn.microsoft.com/azure/role-based-access-control/built-in-roles
- A. Incorrect.
Incorrect. The Owner role has full access to all resources, including the ability to manage role assignments. However, it provides more permissions than needed because it allows creation, modification, and deletion of resources.
- B. Correct.
Correct. The User Access Administrator role is specifically designed to manage role assignments without granting rights to create or modify resources. This matches the requirement to delegate access control management without other resource permissions.
- C. Incorrect.
Incorrect. The Contributor role can create, manage, and delete resources in addition to managing role assignments. This exceeds the minimum privilege needed and does not conform to the 'least privilege' principle.
- D. Incorrect.
Incorrect. The Reader role only provides read access to resources and does not include the ability to manage role assignments.