SC-300 Certification Practice Question #258

Question

You have an Azure subscription named Sub1.

You plan to onboard Microsoft Entra Permissions Management.

You need to ensure that Permissions Management users can manage role assignments for Sub1. The solution must follow the principle of least privilege.

Which role should you assign and to which identity should you assign the role? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Both the question requirement (Permissions Management users must *manage role assignments* = write permission) and MS Learn's "Enable or disable the controller in Azure" procedure point to the same pair. Managing role assignments requires `Microsoft.Authorization/roleAssignments/write`, which among the offered roles only **User Access Administrator** grants (Contributor, Reader, and Security Admin cannot), satisfying least privilege. The doc explicitly instructs the admin to grant this on the **Cloud Infrastructure Entitlement Management** principal that Permissions Management registers, and that exact name appears as an Identity option in the image — so it is the intended target over "Microsoft Azure Management" (which is the Azure portal/management app, not the Permissions Management controller). The 10-👍 Highly Voted comment endorses this MS Learn page, and several lower-vote comments (krzkrzkra, rvln7, Frank9020, Labelfree) name CIEM/Permissions Management as the identity. dzdz's "Microsoft Azure Management" choice (6 👍) is the main dissent; it's discounted because the doc names the CIEM identity, lowering overall confidence into the mid-80s.

More SC-300 practice questions