SC-100 Certification Practice Question #41

Question

You have a Microsoft Entra tenant named contoso.com. You have 30 Azure subscriptions that are linked to contoso.com. The tenant contains the management groups shown in the following table.

You need to design a governance solution to manage access to all the Azure Storage accounts across the subscriptions. The solution must meet the following requirements:

•	Use custom role-based access control (RBAC) to provide granular access to control plane and data plane operations.
•	Minimize administrative effort.

At which scope should you assign the roles, and what is the minimum number of assignments per role? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The requirement explicitly demands a single custom RBAC role that grants **both control plane (Actions) and data plane (DataActions)** operations on the storage accounts. MS Learn is unambiguous that a custom role containing `DataActions` **cannot be assigned at management group scope**, and the root scope `/` is never a valid assignable scope for a custom role. That eliminates every management-group option in the Scope dropdown (root MG, and Mgmt1+Mgmt2), so the role can only be assigned at the **subscription** scope — once per subscription across all 30 subscriptions = **30 assignments**. The two clusters of highly-rated comments (root MG → 1, and Mgmt1+Mgmt2 → 2) each ignore the DataActions limitation, which is the entire point of the question; MS Learn is therefore used as the tiebreaker and confidence is lowered to reflect the genuine community split and the fact that the Scope dropdown has no literal "subscription" label (it is inferred from the 30-assignment pairing).

More SC-100 practice questions