SC-300 Certification Practice Question #107

Question

You have a management group named Group1 that contains two Azure subscriptions named Sub1 and Sub2. The subscriptions are linked to a Microsoft Entra tenant that contains a user named User1.

You need to ensure that User1 can onboard Sub1 to Permissions Management. The solution must follow the principle of least privilege.

Which permission should you grant to User1?

Accepted Answer

Onboarding a subscription to Permissions Management requires creating a role assignment for the Cloud Infrastructure Entitlement Management service principal, which needs the `Microsoft.Authorization/roleAssignments/write` action. MS Learn's onboarding guidance for Azure scopes shows this write permission is checked at the subscription (or management-group) scope being onboarded. Since only Sub1 must be onboarded, granting write at Sub1 (option C) is exactly sufficient, whereas granting it at the parent management group Group1 (option B) over-privileges User1 across both Sub1 and Sub2. The read-only options A and D can't create the assignment at all. Suggested Answer, Most Voted (7 votes), and the top comments all agree on C.

More SC-300 practice questions