Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Contributor Access at Resource Group Scope
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization has hired a team of external developers to build and manage application resources located exclusively within a dedicated resource group named rg-dev-app. The security team requires that access follows security best practices by applying the principle of least privilege and minimizing administrative overhead.
Which action represents the recommended approach for granting access using Azure role-based access control (RBAC)?
Explanations
Assign the Contributor role to individual developer user accounts at the management group scope
Assign the Contributor role to individual developer user accounts at the management group scope
What the Contributor Role at Management Group Scope Does
A management group is a governance container positioned above subscriptions. Assigning the Contributor role at this level grants management access across all subscriptions and underlying resources grouped beneath that management group hierarchy.
Why It Doesn't Meet the Requirement
This configuration represents a major violation of the principle of least privilege regarding assignment scope:
- Overly broad scope: The management group is the broadest scope level in Azure. Assigning access here cascades down through all child subscriptions and resource groups, far exceeding the single
rg-dev-appboundary. - Individual account assignments: Direct role assignments to individual user accounts complicate auditing and access reviews compared to managing access through centralized groups.
Key Limitations
- Cascading inheritance: Permissions flow downward across multiple subscriptions and cannot be blocked at lower child scopes.
- Cross-environment exposure: Grants contractors unintended access to production, staging, and shared corporate subscriptions.
- Administrative burden: Individual user assignment management becomes difficult to track and maintain over time.
This Answer Would Be Correct If
A central cloud platform team needed broad management permissions across multiple subscriptions organized under an enterprise management hierarchy.
Assign the Contributor role to a Microsoft Entra group containing the developers at the resource group scope
Assign the Contributor role to a Microsoft Entra group containing the developers at the resource group scope
What Role-Based Access Control Best Practice Is
Azure role-based access control (Azure RBAC) provides fine-grained access management for Azure resources by matching security principals, role definitions, and scopes. Implementing best practices requires following the principle of least privilege, which means granting users only the permissions they require to perform their jobs, at the exact boundary where those permissions are needed.
How It Meets the Requirements
Assigning the Contributor role at the resource group scope directly addresses the organization's needs:
- Least privilege by role: The Contributor role allows developers to manage all resources (such as creating and configuring services) without granting them permissions to assign roles to others or manage access policies.
- Least privilege by scope: Limiting the assignment to the
rg-dev-appresource group prevents developers from viewing or modifying workloads in other resource groups or subscriptions. - Reduced administrative overhead: Assigning roles to a Microsoft Entra group rather than individual user accounts simplifies user management, as onboarding or offboarding members automatically updates resource access.
Key Advantages
- Granular boundaries: Isolates development activities to a single resource container.
- Group-based governance: Simplifies access lifecycle management across identity systems.
- Restricted administrative privileges: Prevents unauthorized privilege escalation because Contributors cannot modify RBAC role assignments.
- Inheritance control: Child resources within the resource group inherit the permissions automatically without requiring per-resource assignments.
Why This Is Optimal
This solution strikes the right balance between operational efficiency and security guardrails. It grants sufficient operational authority within the intended boundary while preventing sprawl across higher scopes.
Assign the Reader role to a Microsoft Entra group containing the developers at the subscription scope
Assign the Reader role to a Microsoft Entra group containing the developers at the subscription scope
What the Reader Role at Subscription Scope Does
The Reader built-in role allows users to view the configuration and metadata of Azure resources, but it strictly prohibits creating, modifying, or deleting any resources or deployment configurations.
Why It Doesn't Meet the Requirement
While using a Microsoft Entra group is a good administrative practice, this option fails both the functional and scoping requirements:
- Insufficient permissions: The developers need to actively deploy and manage application resources, but the Reader role prevents any write or configuration actions.
- Incorrect scope: Assigning the role at the subscription scope gives developers read visibility into every resource and secret metadata structure across the entire subscription rather than limiting their view to
rg-dev-app.
Key Limitations
- Read-only enforcement: Blocks all resource creation, update, and deletion tasks.
- Subscription-wide visibility: Exposes infrastructure architecture across unrelated projects and workloads.
- Operational barrier: Developers cannot perform routine build, test, and deployment tasks.
This Answer Would Be Correct If
Auditors or compliance officers needed visibility into all configurations across an entire subscription to verify policy alignment without making any operational changes.
Assign the Owner role directly to individual developer user accounts at the subscription scope
Assign the Owner role directly to individual developer user accounts at the subscription scope
What the Owner Role at Subscription Scope Does
The Owner role provides full control over all resources within a specified scope, including the ability to delegate access to other identities by creating and modifying role assignments. Assigning this role at the subscription scope applies those administrative permissions across every resource group and resource within the entire subscription.
Why It Doesn't Meet the Requirement
This approach violates several core security best practices:
- Excessive permissions: Developers only need to manage application resources, but the Owner role gives them full administrative authority, including the ability to alter permissions and access controls.
- Excessive scope: Subscription-level assignments inherit down to all resource groups, exposing unrelated workloads outside
rg-dev-appto unintended modifications. - High administrative overhead: Assigning permissions directly to individual user accounts rather than using a Microsoft Entra group increases maintenance effort and error risk during personnel turnover.
Key Limitations
- Full delegation capabilities: Allows assignees to grant permissions to unauthorized users.
- Broad blast radius: Any security compromise at the subscription scope impacts the entire environment.
- Direct assignment management: Requires manual role revocation for each individual account when contractors leave.
This Answer Would Be Correct If
A trusted lead architect required complete administrative control to configure security baselines, assign RBAC permissions, and manage all workloads across the entire subscription.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC Scope
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC Custom Roles
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC Scope Inheritance
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Monitor Audit Log Retention
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Monitor
Describe the resources required for virtual machines
ExpertAZ-500 Microsoft Azure Security Technologies Exam
Application Permissions vs Delegated Permissions
Configure app registration permission scopes
Last updated Validated