AZ-104 Certification Practice Question #80

Question

You have 15 Azure subscriptions.
You have an Azure Active Directory (Azure AD) tenant that contains a security group named Group1.
You plan to purchase additional Azure subscription.
You need to ensure that Group1 can manage role assignments for the existing subscriptions and the planned subscriptions. The solution must meet the following requirements:
✑ Use the principle of least privilege.
✑ Minimize administrative effort.
What should you do?

Accepted Answer

To allow Group1 to manage role assignments for all current and future subscriptions with the least administrative effort, we should leverage the fact that new subscriptions default to the Tenant Root Management Group. Applying a role at the Root Management Group ensures automatic inheritance across all existing and future subscriptions without manual moves or re-assignments. Under the principle of least privilege, the User Access Administrator role is selected instead of the Owner role because User Access Administrator allows the management of role assignments (permissions access control) without granting full read/write/delete access to resource deployments.

More AZ-104 practice questions