AZ-104 Certification Practice Question #60

Question

You have an Azure subscription linked to an Azure Active Directory tenant. The tenant includes a user account named User1.
You need to ensure that User1 can assign a policy to the tenant root management group.
What should you do?

Accepted Answer

Under Azure RBAC and Microsoft Entra ID design, no user (not even a subscription Owner or default administrator) has direct permissions on the tenant root management group by default. The only built-in method to gain control over the root management group `/` is for a Global Administrator to elevate their own access. In the Azure portal (under Entra ID -> Properties), a Global Administrator can toggle **Access management for Azure resources** to **Yes**, which grants them the **User Access Administrator** role at the root scope `/`. From this elevated position, User1 can then assign policies and manage permissions at the tenant root management group level. Therefore, option C is the only valid solution.

More AZ-104 practice questions