Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Assigning RBAC Roles at Resource Group Scope
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An administrator needs to grant a developer team the ability to manage virtual machines and storage within a specific resource group without giving them access to the rest of the Azure subscription.
After navigating to the target resource group in the Azure portal, which menu option must the administrator select to configure this role assignment?
Explanations
Resource locks
Resource locks
What Resource locks are
Resource locks are Azure management safeguards that prevent accidental deletion or unwanted modification of critical Azure resources. They apply uniformly to all users regardless of their assigned permissions, offering two lock levels: ReadOnly (authorized users can read a resource, but cannot delete or update it) and CanNotDelete (authorized users can read and modify a resource, but cannot delete it).
Why it doesn't meet the requirement
Resource locks do not grant, configure, or delegate user authorization or roles. They only act as guardrails to prevent accidental destructive actions. Applying a resource lock does not enable developers to manage or deploy resources.
Key characteristics and limitations
- Universal application: Applies restrictions across all users and administrators, overriding standard write or delete permissions.
- No identity assignment: Cannot be targeted to specific users, groups, or service principals.
- Limited modes: Only supports ReadOnly and Delete protection types.
This answer would be correct if
The scenario required preventing team members from accidentally deleting a production resource group or altering its configurations.
Additional context
While resource locks protect infrastructure stability, authorization and administrative rights must always be granted through Azure RBAC via Access control (IAM).
Tags
Tags
What Tags are
Tags are metadata elements consisting of key-value pairs that are attached directly to Azure resources, resource groups, and subscriptions. They are primarily utilized to categorize assets for cost tracking, billing allocation, asset inventory, and workload ownership identification.
Why it doesn't meet the requirement
Tags contain purely informational metadata and do not provide authorization capabilities or permission delegation. Adding or editing tags does not grant any user permissions to create, update, or manage virtual machines or other resources.
Key characteristics and limitations
- Metadata only: Stores simple key-value pairs (e.g.,
Environment: Development,CostCenter: IT). - No security enforcement: Does not inherently restrict or grant operational access to resources.
- Non-inheritable by default: Child resources inside a resource group do not automatically inherit the parent resource group's tags.
This answer would be correct if
The scenario required organizing resources for billing reports or categorizing environments by department or project code.
Additional context
Although Azure Policy can evaluate tags to enforce governance rules, user authorization must always be assigned using Azure RBAC in the Access control (IAM) blade.
Access control (IAM)
Access control (IAM)
What Access control (IAM) is
Access control (IAM), which stands for Identity and Access Management, is the dedicated management blade in the Azure portal used to manage Azure role-based access control (Azure RBAC). It provides a centralized interface to view existing access rights, check effective permissions, and assign built-in or custom roles to security principals.
How it meets the requirement
Selecting Access control (IAM) on the specific resource group allows administrators to:
- Open the Role assignments tab and select + Add > Add role assignment.
- Choose an appropriate role definition (such as Contributor or Virtual Machine Contributor) to grant precise privileges.
- Target the exact scope (the resource group level), ensuring that permissions automatically cascade to child resources within that group while preventing unauthorized access to other resources in the subscription.
Key advantages and capabilities
- Principle of least privilege: Restricts user capabilities to only the operations and resources needed for their duties.
- Support for multiple principal types: Allows assigning roles to individual users, Microsoft Entra groups, service principals, and managed identities.
- Inheritance management: Clearly illustrates inherited permissions from parent scopes like management groups and subscriptions.
- Auditability and visibility: Provides instant visibility into who has access and at what level through downloadable role assignment lists.
Why this is optimal
Access control (IAM) is the native, secure mechanism in the Azure portal designed specifically for governing authorization across Azure resources. Managing permissions here ensures granular access enforcement and compliance with security baselines.
Azure Policy
Azure Policy
What Azure Policy is
Azure Policy is a governance service in Azure that evaluates resources against defined business rules and compliance standards. It automatically enforces conventions, audits resource properties, and prevents non-compliant deployments (such as blocking specific virtual machine sizes or enforcing mandatory tags).
Why it doesn't meet the requirement
Azure Policy focuses on resource properties, configurations, and deployment conditions rather than user identity authorization. It cannot grant user access rights or assign management permissions to security principals.
Key characteristics and limitations
- Configuration governance: Enforces rules over resource configurations and properties at scale.
- Guardrails, not access: Acts as a compliance guardrail rather than an identity and access management tool.
- Policy effects: Uses effects like Audit, Deny, Append, and Modify to enforce standards during deployment.
This answer would be correct if
The goal was to ensure that all resources created within the resource group conform to organizational standards, such as restricting deployments to specific Azure regions.
Additional context
Azure RBAC and Azure Policy work together for cloud governance: Azure RBAC controls who can perform actions on resources, while Azure Policy controls what configurations can be deployed.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Portal Resource Blade
Describe the Azure portal
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Tags
Describe the Azure portal
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Dashboards
Describe the Azure portal
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Monitor Metrics Explorer
Describe the Azure portal
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
ARM Template Secure Parameters
Describe Azure Resource Manager (ARM) and ARM templates
ExpertAZ-500 Microsoft Azure Security Technologies Exam
Application Permissions vs Delegated Permissions
Configure app registration permission scopes
Last updated Validated