AZ-104 Certification Practice Question #95

Question

You have three Azure subscriptions named Sub1, Sub2, and Sub3 that are linked to an Azure AD tenant.

The tenant contains a user named User1, a security group named Group1, and a management group named MG1. User is a member of Group1.

Sub1 and Sub2 are members of MG1. Sub1 contains a resource group named RG1. RG1 contains five Azure functions.

You create the following role assignments for MG1:

•	Group1: Reader
•	User1: User Access Administrator

You assign User the Virtual Machine Contributor role for Sub1 and Sub2.

Accepted Answer

1. **Statement 1 (Yes):** Group1 is assigned the **Reader** role at the management group `MG1` level. Because resource groups and resources under subscriptions inherit permissions from their parent management groups, Group1 members have inherited Reader access to `Sub1`, `RG1`, and the Azure functions. The Reader role permits viewing configurations and properties.
2. **Statement 2 (Yes):** User1 is assigned the **User Access Administrator** role at the management group `MG1` level. This allows User1 to manage role assignments (including assigning the **Owner** role) for all descendant resources, including `RG1`.
3. **Statement 3 (No):** User1 is a User Access Administrator (which only manages role assignments, not resource deployment). Even if User1 is also "User" (who has the **Virtual Machine Contributor** role for the subscriptions), the Virtual Machine Contributor role only allows managing virtual machines and running deployments, but it explicitly lacks the permission to create new resource groups (`Microsoft.Resources/subscriptions/resourceGroups/write`). Thus, they cannot create a new resource group.

More AZ-104 practice questions