Start here! Get your feet wet with the Microsoft cloud and begin your journey to earning your Microsoft Certified: Azure Fundamentals certification!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
An organization is configuring access permissions for its tier-1 IT support staff in Azure. The support staff must be able to view all resource configurations across an Azure subscription and open technical support tickets with Microsoft.
However, corporate security policy dictates that the support staff must not have permissions to create, modify, or delete resources, nor manage user access assignments. The standard Azure built-in roles do not provide this exact combination of permissions.
Which solution should the organization implement to meet these requirements while adhering to the principle of least privilege?
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
An Azure custom role is a user-defined role definition in Azure Role-Based Access Control (Azure RBAC) that provides tailored access control when the pre-configured Azure built-in roles do not match organizational requirements.
StudyCerts
StudyCerts*/read action, allowing support engineers to view all resource configurations across the subscription.Microsoft.Support/* actions, granting the ability to create, update, and manage support tickets with Microsoft.Actions) and restricted operations (NotActions) can be precisely tailored.When no single built-in role (such as Owner, Contributor, or Reader) provides the exact balance of required operational actions without granting excess permissions, authoring an Azure custom role is the recommended and architecturally correct approach.