SC-300 Certification Practice Question #261

Question

You have an Azure subscription named Sub1.

You plan to deploy Microsoft Entra Permissions Management.

You need to ensure that Permission Management can onboard Sub1. The solution must follow the principle of least privilege.

How should you complete the PowerShell command? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The command's parameter shape (`-ApplicationId -RoleDefinitionName -Scope "/subscriptions/"`) is exactly the `New-AzRoleAssignment` service-principal parameter set documented on MS Learn, so the cmdlet must be New-AzRoleAssignment (the other two cmdlets don't accept these parameters). For the role, the Permissions Management quickstart explicitly states the CIEM enterprise application needs the **Reader** role to read/scan subscriptions during onboarding, and least privilege rules out Contributor and Owner. The top-voted community comment cites the same MS Learn page. Confidence is held at 88 (not higher) because the file records no official Suggested Answer or Most Voted letter, and the product is being retired (no fresh validation).

More SC-300 practice questions