SC-300 Certification Practice Question #257

Question

You have an Azure subscription.

You need to use Microsoft Entra Permissions Management to automatically monitor permissions and create and implement right-size roles. The solution must follow the principle of least privilege.

Which role should you assign to the service principal of Permissions Management?

Accepted Answer

Permissions Management needs to do two things on the onboarded Azure subscription — read the current permission landscape and then create/assign right-sized roles — while staying least-privileged. User Access Administrator is the only built-in role that grants `Microsoft.Authorization/roleAssignments/*` (so it can both evaluate assignments and assign/remediate roles) without also granting the broad resource-management rights of Contributor or the full control of Owner. Reader can monitor but cannot remediate, Contributor can modify resources but not role assignments, and Owner over-grants. Suggested Answer, Most Voted, and the top comment (dzdz, 13 👍) all agree on A, corroborated by MS Learn. Confidence is 87 rather than higher because the role's permission match is inferred from RBAC docs (the dedicated Permissions Management onboarding page was not retrieved, and that product is being retired), and there is scattered low-vote dissent toward Owner/Contributor/Reader.

More SC-300 practice questions