AZ-104 Certification Practice Question #97

Question

You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.

Subscription1 has a user named User1. User1 has the following roles:

•	Reader
•	Security Admin
•	Security Reader

You need to ensure that User1 can assign the Reader role for VNet1 to other users.

What should you do?

Accepted Answer

To delegate the ability to assign roles to other users, a user must have role assignment write permissions (`Microsoft.Authorization/roleAssignments/write`). The two built-in Azure RBAC roles that possess this capability are Owner and User Access Administrator. The Contributor role lets you manage resources but explicitly lacks authorization/role assignment write privileges. Therefore, assigning the User Access Administrator role at the scope of VNet1 satisfies the requirement cleanly with the principle of least privilege, allowing User1 to delegate the Reader role for VNet1 to others.

More AZ-104 practice questions