Hotspot Question You have an Azure subscription that is linked to an Azure AD tenant. The tenant contains the custom role-based access control (RBAC) roles shown in the following table. From the Azure

Question

Exhibits

Answer Area

• Role3:Role1, Role2, built-in Azure subscription roles, and built-in Azure AD roles
  Role1 onlyBuilt-in Azure subscription roles onlyRole1 and built-in Azure subscription roles onlyBuilt-in Azure subscription roles and built-in Azure AD roles onlyRole1, Role2, built-in Azure subscription roles, and built-in Azure AD roles
• Role4:Role1, Role2, built-in Azure AD, and built-in Azure subscription roles
  Role2 onlyBuilt-in Azure AD roles onlyRole2 and built-in Azure AD roles onlyBuilt-in Azure AD roles and built-in Azure subscription roles onlyRole1, Role2, built-in Azure AD, and built-in Azure subscription roles

Explanation

To create a custom Azure subscription role (Role3), you can only clone existing custom Azure subscription roles or built-in Azure subscription roles; similarly, for a custom Azure AD role (Role4), you can only clone existing custom Azure AD roles or built-in Azure AD roles, respecting their distinct assignable scopes.

Approach. The question requires creating Role3 as an Azure subscription role and Role4 as an Azure AD role. The ability to clone a role is restricted by its 'AssignableScopes' and type:

1. For Role3 (an Azure subscription role): You must select 'Role1 and built-in Azure subscription roles only'.

   • Reasoning: Azure subscription roles are primarily for managing Azure resources within subscriptions, resource groups, or individual resources. Their AssignableScopes are typically set to /subscriptions/xxxxx or a more granular resource path. Therefore, you can only clone other roles that are also designed for Azure resource management.
     • Built-in Azure subscription roles are inherently scoped for Azure resources and can be cloned to create new custom subscription roles.
     • Role1 is implied to be an existing custom Azure subscription role (with subscription-level AssignableScopes), making it a valid source for cloning.
     • You cannot clone Azure AD roles (either built-in Azure AD roles or a custom Azure AD role like Role2) to create an Azure subscription role because their scope (/ for tenant-level) and purpose are fundamentally different.

2. For Role4 (an Azure AD role): You must select 'Role2 and built-in Azure AD roles only'.

   • Reasoning: Azure AD roles are specifically for managing Azure Active Directory objects, identities, and related services. Their AssignableScopes are typically set to / (the tenant root). Thus, you can only clone other roles designed for Azure AD management.
     • Built-in Azure AD roles are inherently scoped for Azure AD and can be cloned to create new custom Azure AD roles.
     • Role2 is implied to be an existing custom Azure AD role (with tenant-level AssignableScopes), making it a valid source for cloning.
     • You cannot clone Azure subscription roles (either built-in Azure subscription roles or a custom Azure subscription role like Role1) to create an Azure AD role due to the incompatibility in their scopes and functions.

Common mistakes.

• common_mistake. The most common mistake is failing to differentiate between Azure Resource Manager (ARM) RBAC roles (used for Azure resource authorization) and Azure Active Directory (Azure AD) roles (used for Azure AD directory authorization). Test-takers might mistakenly believe that any existing role can be cloned to create any new custom role, regardless of its type or assignable scope.

• Incorrectly mixing role types: Options that suggest cloning built-in Azure AD roles for an Azure subscription role (e.g., 'Built-in Azure subscription roles and built-in Azure AD roles only' for Role3) or cloning built-in Azure subscription roles for an Azure AD role (e.g., 'Built-in Azure AD roles and built-in Azure subscription roles only' for Role4) are wrong because these role types have distinct 'AssignableScopes' and cannot be interchanged during cloning. You cannot clone an Azure AD role to create an ARM RBAC role, and vice versa.
• Being too restrictive: Options like 'Role1 only' or 'Built-in Azure subscription roles only' for Role3 are wrong because they exclude other valid cloning sources (either the custom role or the built-in roles, respectively) that have compatible scopes. The question asks 'Which roles can you clone', implying all valid options should be considered.
• Being too permissive: Options that include all roles (e.g., 'Role1, Role2, built-in Azure subscription roles, and built-in Azure AD roles' for either Role3 or Role4) are incorrect as they disregard the critical distinction between ARM RBAC and Azure AD roles, suggesting an impossible cross-type cloning.

Concept tested. The core concept tested is the understanding of Azure custom roles, specifically the fundamental distinction between Azure Resource Manager (ARM) RBAC roles and Azure Active Directory (Azure AD) roles. This includes knowledge of their differing AssignableScopes properties and the rules governing role cloning in the Azure portal, emphasizing that a role can only be cloned to create a new custom role of the same underlying type (ARM RBAC to ARM RBAC, or Azure AD to Azure AD).

Reference. https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles

No community discussion yet for this question.