Task 1.2: Manage access to Azure resources

• AUser Access Administrator on the resource group

  Incorrect

  User Access Administrator can assign any role, including Owner and User Access Administrator, so it doesn't stop escalation.

• BOwner on the resource group, with a ReadOnly lock on it

  Incorrect

  Owner can assign any role, and a ReadOnly lock blocks changes to resources rather than limiting which roles are granted.

• CContributor on the resource group

  Incorrect

  Contributor manages resources but can't create role assignments at all, so the team lead couldn't assign either role.

• DRole Based Access Control Administrator with a condition that constrains roles

  Correct

  This role can create role assignments, and a constrain-roles condition limits it to the two roles you list.

Role Based Access Control Administrator can manage role assignments without other resource permissions, and a role assignment condition can constrain the roles (and principal types) the delegate may assign. Owner and User Access Administrator can assign any role.

• AManage resources in RG-App, and read everything else under Production

  Correct

  Permissions are the sum of the role assignments, and each assignment applies to its scope and every scope below it.

• BManage resources in each subscription under Production

  Incorrect

  Contributor is granted only at RG-App; Reader is the only role the user holds on the other resource groups and subscriptions.

• CRead RG-App, because the management group assignment wins

  Incorrect

  Azure RBAC has no "higher scope wins" rule; assignments add up, so the Contributor role on RG-App still applies.

• DManage RG-App, but see nothing else until Reader is reassigned per subscription

  Incorrect

  A role assigned at a management group is inherited by its subscriptions, resource groups and resources; no per-subscription copy is needed.

Azure RBAC is additive: the effective permissions are the union of the role assignments. A role assigned at a scope is inherited by all child scopes, so Reader flows down from the management group while Contributor adds write access in RG-App.

• AVirtual Machine Contributor

  Incorrect

  Virtual Machine Contributor manages the VM resource; like Contributor, it doesn't grant the right to sign in to the operating system.

• BVirtual Machine Administrator Login

  Correct

  This role lets a user view the VM in the portal and sign in to it with administrator privileges through Microsoft Entra ID.

• CVirtual Machine User Login

  Incorrect

  This role allows Entra sign-in with regular user privileges only, not as an administrator.

• DOwner, assigned on the virtual machine

  Incorrect

  Owner or Contributor alone doesn't grant sign-in privileges to a VM; the login roles are kept separate on purpose.

Control of the VM resource and sign-in to its operating system are separated. Owner and Contributor don't grant sign-in; Virtual Machine Administrator Login grants administrator sign-in and Virtual Machine User Login grants standard sign-in.

• AActivate the Privileged Role Administrator role for yourself

  Incorrect

  Privileged Role Administrator manages Entra role assignments; it doesn't give access to Azure subscriptions.

• BAssign yourself Owner on each subscription's Access control (IAM) page

  Incorrect

  You can't see the subscriptions, so you hold no permission to add role assignments on them until you elevate.

• CTurn on Access management for Azure resources in the Entra properties

  Correct

  Elevating access assigns you User Access Administrator at root scope (/), so you can assign roles in every subscription and management group.

• DAssign yourself the Owner role on the Tenant Root Group management group

  Incorrect

  Without elevated access you have no permission on the root management group, so you can't create that assignment yourself.

Entra roles and Azure roles are separate. A Global Administrator can elevate access with the "Access management for Azure resources" toggle, which assigns User Access Administrator at root scope; the elevation should be removed when the work is done.

• AContributor

  Incorrect

  Contributor can change the resources themselves, which isn't allowed.

• BMonitoring Reader

  Incorrect

  Monitoring Reader reads monitoring data but can't edit monitoring settings.

• CLog Analytics Reader

  Incorrect

  This role reads log data and workspace settings; it doesn't manage alerts.

• DMonitoring Contributor

  Correct

  Monitoring Contributor reads all monitoring data and edits monitoring settings.

Monitoring Contributor is the built-in role for managing monitoring settings such as alerts and diagnostic settings; Monitoring Reader only reads the data.

• AReader

  Incorrect

  Reader can view resources but not change them or grant access.

• BContributor

  Incorrect

  Contributor manages resources but can't assign roles.

• COwner

  Correct

  Owner grants full access to manage resources, including the ability to assign roles.

• DUser Access Administrator

  Incorrect

  This role manages access but doesn't let the lead create resources.

Owner combines resource management with role assignment. Contributor lacks role assignment, and User Access Administrator lacks resource management.

• Aaz role assignment create --assignee dana@contoso.com --role Reader --scope /subscriptions/1111-2222/resourceGroups/RG1

  Correct

  The scope is the resource ID of RG1, so the role applies to that resource group and its resources.

• Baz role definition create --assignee dana@contoso.com --role Reader --scope /subscriptions/1111-2222/resourceGroups/RG1

  Incorrect

  az role definition create creates a custom role; it doesn't assign one.

• Caz ad group member add --member-id dana@contoso.com --group Reader

  Incorrect

  This adds a user to an Entra group; there's no group called Reader that carries the Azure role.

• Daz role assignment create --assignee dana@contoso.com --role Reader --scope /subscriptions/1111-2222

  Incorrect

  This scope is the whole subscription, which grants Reader on every resource group in it.

az role assignment create takes the principal, the role and the scope. The scope is a resource ID such as /subscriptions/<id>/resourceGroups/<name>.

• AContributor

  Incorrect

  Contributor can change and delete resources.

• BOwner

  Incorrect

  Owner can change resources and assign roles, which the staff must not do.

• CReader

  Correct

  Reader views all resources but doesn't allow changes.

• DUser Access Administrator

  Incorrect

  This role manages access to resources; it isn't meant for viewing configuration.

Reader is the built-in view-only role at any scope. Contributor adds the right to change resources, and Owner the right to assign roles.