Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
How Azure RBAC Subscription Scope Inheritance Works
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization manages an Azure environment with a subscription named Sub-Production that contains multiple resource groups and services.
The cloud administrator needs to grant the Tier-2 Support group permissions to manage all existing resources within Sub-Production. Additionally, any new resource groups or resources created inside Sub-Production in the future must automatically inherit these permissions without requiring additional manual role assignments.
At which scope should the administrator assign the role?
Explanations
Subscription
Subscription
What Subscription Scope Is
In Azure role-based access control (Azure RBAC), a scope defines the boundary or set of resources that an access grant applies to. The subscription scope sits directly below management groups and above resource groups in the Azure resource hierarchy.
How It Meets the Requirement
Assigning a role at the subscription scope satisfies both organizational needs:
- Broad coverage: Permissions granted at the subscription level apply to all child resource groups and all individual resources within that subscription.
- Automatic inheritance: Under Azure RBAC scope inheritance, any new resource groups or individual resources deployed into Sub-Production automatically inherit this role assignment without administrative intervention.
Key Advantages and Capabilities
- Hierarchical inheritance: Permissions cascade downward through the entire resource hierarchy from parent to child containers.
- Reduced administrative overhead: Eliminates the need to manually assign roles every time a new workload, container, or service is provisioned.
- Centralized access control: Allows administrators to maintain unified governance across an entire subscription boundary.
- Consistent security baselines: Guarantees that operational teams have uninterrupted, standardized access across all environment assets.
Why This Is Optimal
Assigning permissions at the subscription level provides the exact boundary requested. It encompasses all existing and future resources within Sub-Production without granting unintended access to other subscriptions in the organization.
Management group
Management group
What Management Group Scope Is
A management group scope sits above subscriptions in the Azure hierarchy. Management groups provide a container to manage access, policies, and compliance across multiple Azure subscriptions simultaneously.
Why It Doesn't Meet the Requirement
Assigning the role at the management group scope violates the principle of least privilege because the permissions would cascade down to all subscriptions organized under that management group. The scenario specifies granting permissions solely within the Sub-Production subscription, not across other subscriptions.
Key Characteristics and Limitations
- Multi-subscription governance: Applies access policies and role assignments across large organizational subscription hierarchies.
- Broad downward inheritance: Roles assigned here are inherited by all child management groups, member subscriptions, resource groups, and resources.
- Excessive privilege risk: Assigning a role here when only one subscription requires access grants unnecessary permissions across sibling subscriptions.
This Answer Would Be Correct If
The organization wanted the Tier-2 Support team to manage resources across all subscriptions in the enterprise hierarchy simultaneously.
Additional Context
Management groups are ideal for broad governance and enterprise-wide baseline policies, but single-subscription requirements should be scoped directly to the target subscription.
Individual resource
Individual resource
What Individual Resource Scope Is
The individual resource scope is the narrowest level in the Azure RBAC hierarchy. It applies a role assignment directly to a single Azure service instance, such as a specific virtual machine, storage account, or virtual network.
Why It Doesn't Meet the Requirement
Assigning permissions at the resource scope grants access only to that specific asset. It provides no visibility or management capabilities over any other resources in the same resource group or subscription. Furthermore, it cannot provide automatic inheritance for newly provisioned resources.
Key Characteristics and Limitations
- Granular control: Designed for the principle of least privilege when access must be limited to a single specific endpoint or service.
- No child containers: Individual resources are leaf nodes in the hierarchy and cannot pass permissions down to other independent services.
- High administrative overhead: Requires continuous manual role creation for every individual asset deployed in the subscription.
This Answer Would Be Correct If
A team member required access to manage only a single virtual machine or database without having permissions to view or edit any other resource in the group or subscription.
Additional Context
Managing permissions at the individual resource level is generally reserved for tightly controlled exceptions to avoid administrative complexity.
Resource group
Resource group
What Resource Group Scope Is
A resource group scope restricts role assignments to a specific logical container and the individual resources located directly inside that container.
Why It Doesn't Meet the Requirement
While a role assigned at a resource group scope is inherited by all resources inside that specific group, it does not span across multiple resource groups. If the administrator assigns the role at the resource group level, the Tier-2 Support team will only have access to that single group. They would not receive permissions for other existing resource groups or any newly created resource groups in the subscription unless manual assignments are added for each one.
Key Characteristics and Limitations
- Targeted boundary: Restricts user and service access strictly to resources within one specific group.
- No horizontal inheritance: Permissions do not propagate across sibling resource groups within the same parent subscription.
- Increased maintenance: Requires creating and maintaining separate role assignments for every resource group in the subscription.
This Answer Would Be Correct If
The organization needed to restrict the support team's permissions strictly to a single project or workload isolated in one dedicated resource group.
Additional Context
In Azure RBAC, inheritance flows downward, not upward or sideways. A resource group cannot pass its role assignments up to the subscription or over to sibling resource groups.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Monitor Audit Log Retention
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC Custom Roles
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC Scope and Role Assignment
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC Scope
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Manager Templates
Describe the benefits of manageability in the cloud
ExpertAZ-305 Designing Microsoft Azure Infrastructure Solutions Exam
Azure Monitor Cost Optimization Design
Recommend a monitoring solution
Last updated Validated