Question
You have an Azure management group named MG1 that contains two subscriptions named Sub1 and Sub2. Both subscriptions are linked to a Microsoft Entra tenant that contains a security group named Group1.
You need to ensure that the members of Group1 can assign roles to the resources in Sub1 and Sub2. The solution must follow the principle of least privilege.
Which role should you assign to Group1?
- A. Contributor at the MG1 scope
- B. Contributor at the Sub1 and Sub2 scopes
- C. User Access Administrator at the MG1 scope Correct
- D. Owner at the MG1 scope
Explanation
User Access Administrator includes the Microsoft.Authorization permissions needed to manage role assignments, and assigning it at MG1 is inherited by both subscriptions. Contributor is wrong at any scope because it explicitly cannot assign roles in Azure RBAC. Owner can assign roles but also grants full management of all resources, which is more than the task needs and breaks least privilege.
