Question
You have two management groups named MG1 and MG2 that contain multiple Azure subscriptions. The subscriptions are linked to a Microsoft Entra tenant.
You have a user named User1 and a global administrator named Admin1.
You are informed that User1 created an Azure subscription named Sub1 under the MG2 management group and is the only owner of the subscription.
You need to ensure that Admin1 can remove the Owner role from User1 for Sub1.
What should you do first?
- A. Move Sub1 to MG1.
- B. Assign Admin1 the User Access Administrator role for Sub1.
- C. Instruct Admin1 to use Privileged Identity Management (PIM) to request the Security Administrator role.
- D. Instruct Admin1 to enable Access management for Azure resources. Correct
Explanation
Microsoft Entra roles do not grant access to Azure resources, so a Global Administrator has no rights on Sub1 by default. Setting Access management for Azure resources to Yes gives Admin1 the User Access Administrator role at root scope, which allows managing role assignments in every subscription and management group in the tenant. Assigning that role directly on Sub1 would need someone with rights on Sub1, and User1 is its only owner. Moving the subscription does not give Admin1 any access, and Security Administrator is a Microsoft Entra role that cannot change Azure role assignments.
