AZ-500 Question 9
Single answerYou have created a custom Azure role definition that allows users to read all resources and start or restart virtual machines, but you originally defined the custom role at the resource group scope. Now you want to assign this role to users at the subscription scope so they can manage VM operations across all resource groups. However, you cannot see the custom role listed when attempting to assign it at the subscription level. Which action enables you to use this custom role at the subscription scope?
- A
Redefine the role at the subscription scope so that the role definition is created and stored at that higher scope.
- B
Grant the role assignment for this role at the resource group scope and rely on it to automatically propagate to the subscription scope.
- C
Enable the 'assignmentAllowedScopes' setting in Microsoft Entra ID to permit broader usage of the existing role definition.
- D
Create a new custom role in Microsoft Entra ID (formerly Azure AD) rather than Azure Resource Manager, so it appears at the subscription scope.
Show answer and explanation
Correct answer: A
Explanation
When creating custom roles in Azure RBAC, the role definition is bound to a specific scope (management group, subscription, resource group, or resource). If you need to assign the same role at a broader or different scope, you must define the role at that desired scope. According to Microsoft documentation (https://learn.microsoft.com/azure/role-based-access-control/custom-roles), custom roles cannot automatically move to higher-level scopes once created. Instead, the role needs to be redefined or updated at the correct scope for it to become available there.
- A. Correct.
Correct. In Azure Role-Based Access Control (RBAC), a custom role is only visible and assignable within the scope where it was defined and its descendants. If you create a custom role at a resource group scope, it will not appear at the subscription scope. To assign it at the subscription level, you must define (or re-create) the role at the subscription scope.
- B. Incorrect.
Incorrect. Role definitions created at a lower scope (such as a resource group) do not automatically propagate upward to a higher scope (e.g., a subscription). They remain restricted to their defined scope and its child resources.
- C. Incorrect.
Incorrect. 'assignmentAllowedScopes' is a setting used when defining custom roles in Azure Resource Manager templates to list acceptable scopes. However, simply enabling or modifying this property in Microsoft Entra ID does not move a role definition created at the resource group scope into the subscription scope.
- D. Incorrect.
Incorrect. There is a distinction between Azure resource roles (Azure RBAC) and Microsoft Entra ID administrative roles. Creating a Microsoft Entra ID role does not grant Azure resource-level access at the subscription level. You need a custom role defined in Azure Resource Manager at the correct scope for subscription assignments.