Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Azure RBAC Custom Roles for Least Privilege Support Access
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is configuring access permissions for its tier-1 IT support staff in Azure. The support staff must be able to view all resource configurations across an Azure subscription and open technical support tickets with Microsoft.
However, corporate security policy dictates that the support staff must not have permissions to create, modify, or delete resources, nor manage user access assignments. The standard Azure built-in roles do not provide this exact combination of permissions.
Which solution should the organization implement to meet these requirements while adhering to the principle of least privilege?
Explanations
Assign the Owner built-in role to the support staff at the subscription scope
Assign the Owner built-in role to the support staff at the subscription scope
What the Owner Role Is
The Owner role is a foundational Azure built-in role that grants full management access to all resources within a specified scope, including the authority to assign access permissions to other users.
Why It Doesn't Meet the Requirement
Assigning the Owner role directly violates the principle of least privilege and corporate security requirements. An Owner has complete administrative control over the subscription, allowing users to create, modify, delete resources, and delegate administrative permissions, whereas the scenario requires read-only resource access and support ticket creation only.
Key Characteristics and Limitations
- Full administrative control: Permits full configuration, resource lifecycle management, and resource deletion.
- Access management capability: Allows granting and revoking Role-Based Access Control (RBAC) role assignments.
- Privileged security tier: Intended strictly for trusted subscription administrators rather than general helpdesk or support personnel.
This Answer Would Be Correct If
This option would be correct if the administrator needed complete control over all subscription resources, including the ability to delegate access permissions and manage role assignments for other team members.
Additional Context
Using privileged administrator roles like Owner for daily operational or support tasks introduces significant security risks, such as accidental resource deletion or unauthorized privilege escalation.
Create and assign an Azure RBAC custom role with read permissions and support ticket actions
Create and assign an Azure RBAC custom role with read permissions and support ticket actions
What Azure Custom Roles Are
An Azure custom role is a user-defined role definition in Azure Role-Based Access Control (Azure RBAC) that provides tailored access control when the pre-configured Azure built-in roles do not match organizational requirements.
How It Meets the Requirements
- Meets visibility requirement: Incorporates the
*/readaction, allowing support engineers to view all resource configurations across the subscription. - Meets support ticket requirement: Includes
Microsoft.Support/*actions, granting the ability to create, update, and manage support tickets with Microsoft. - Enforces security constraints: Excludes write and delete actions on Azure infrastructure resources, ensuring staff cannot modify or delete assets.
- Maintains least privilege: Prevents unauthorized role assignments and access governance changes.
Key Advantages and Capabilities
- Granular permission control: Specific allowed operations (
Actions) and restricted operations (NotActions) can be precisely tailored. - Flexible assignable scopes: Can be assigned at the management group, subscription, or resource group level.
- Multi-tool deployment: Can be created and maintained using the Azure portal, Azure CLI, Azure PowerShell, or ARM templates via JSON definitions.
- Security compliance: Aligns with organizational compliance standards by eliminating unnecessary administrative privileges.
Why This Is Optimal
When no single built-in role (such as Owner, Contributor, or Reader) provides the exact balance of required operational actions without granting excess permissions, authoring an Azure custom role is the recommended and architecturally correct approach.
Assign the Reader built-in role to the support staff at the subscription scope
Assign the Reader built-in role to the support staff at the subscription scope
What the Reader Role Is
The Reader role is an Azure built-in role designed to provide read-only access to view all resources, configurations, and settings within a specified management group, subscription, or resource group.
Why It Doesn't Meet the Requirement
Although the Reader role satisfies the requirement to view resource configurations without making changes, it lacks permissions under the Microsoft.Support resource provider. As a result, users assigned only the built-in Reader role cannot open or manage official Microsoft support tickets.
Key Characteristics and Limitations
- Read-only visibility: Allows viewing resource details, deployment status, and metrics across the scope.
- No write or action rights: Prevents all write operations, including resource deployment and opening support requests.
- Immutable definition: Built-in roles cannot be modified to add custom actions or tailored permissions.
This Answer Would Be Correct If
This option would be correct if the support team only needed audit or monitoring visibility across the subscription without the requirement to create or manage Microsoft technical support tickets.
Additional Context
To satisfy both visibility and ticketing needs without over-privileging users, organizations frequently combine permissions or define a custom role based on the Reader baseline.
Assign the Contributor built-in role to the support staff at the subscription scope
Assign the Contributor built-in role to the support staff at the subscription scope
What the Contributor Role Is
The Contributor role is a core Azure built-in role that allows users to create, manage, and delete all types of Azure resources within a given scope, without allowing them to grant access to others.
Why It Doesn't Meet the Requirement
While the Contributor role prevents users from managing access control (delegating permissions to other users), it grants full permissions to deploy, modify, and delete Azure resources. This violates the requirement that support engineers must not be able to create, modify, or delete any resources.
Key Characteristics and Limitations
- Resource management control: Can create, update, restart, and delete virtual machines, databases, networks, and storage accounts.
- No access delegation: Cannot assign roles or manage permissions in Access Control (IAM).
- Excessive permissions: Exceeds the read-only operational boundaries needed for helpdesk and support staff.
This Answer Would Be Correct If
This option would be correct if the support staff were responsible for actively deploying, modifying, and maintaining cloud infrastructure components while being restricted from modifying user permissions.
Additional Context
Contributor is typically assigned to DevOps engineers and workload owners who require broad infrastructure modification rights without tenant or subscription governance capabilities.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC Scope and Role Assignment
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC Scope Inheritance
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Monitor Audit Log Retention
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC Scope
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model Physical Security
Describe the shared responsibility model
AdvancedAZ-104 Microsoft Azure Administrator Exam
Availability Zones High Availability
Deploy virtual machines to availability zones and availability sets
Last updated Validated