az-104 Practice Question 741
Exam: az-104
Domain: Describe Azure architecture and services
Topic: Describe Azure identity, access, and security
Difficulty: medium
You have 15 Azure subscriptions.
You have an Azure Active Directory (Azure AD) tenant that contains a security group named Group1.
You plan to purchase additional Azure subscription.
You need to ensure that Group1 can manage role assignments for the existing subscriptions and the planned subscriptions. The solution must meet the following requirements:
✑ Use the principle of least privilege.
✑ Minimize administrative effort.
What should you do?
Answer Options
A
Assign Group1 the Owner role for the root management group.
B
Assign Group1 the User Access Administrator role for the root management group.
C
Create a new management group and assign Group1 the User Access Administrator role for the group.
D
Create a new management group and assign Group1 the Owner role for the group.
Correct Answer
B: Assign Group1 the User Access Administrator role for the root management group.
Explanation
The User Access Administrator role enables the user to grant other users access to Azure resources. This switch can be helpful to regain access to a subscription.
Management groups give you enterprise-grade management at scale no matter what type of subscriptions you might have.
Each directory is given a single top-level management group called the "Root" management group. This root management group is built into the hierarchy to have all management groups and subscriptions fold up to it. This root management group allows for global policies and Azure role assignments to be applied at the directory level.