AZ-500 · Question #197
You have an Azure subscription named Subcription1 that contains an Azure Active Directory (Azure AD) tenant named contoso.com and a resource group named RG1. You create a custom role named Role1 for…
The correct answer is D. contoso.com, RG1, and Subcription1. A custom role created for an Azure AD tenant can be used for permission delegation across the entire tenant hierarchy, including all associated subscriptions and resource groups.
Question
Options
- Acontoso.com only
- Bcontoso.com and RG1 only
- Ccontoso.com and Subscription1 only
- Dcontoso.com, RG1, and Subcription1
How the community answered
(23 responses)- A9% (2)
- B4% (1)
- C4% (1)
- D83% (19)
Why each option
A custom role created for an Azure AD tenant can be used for permission delegation across the entire tenant hierarchy, including all associated subscriptions and resource groups.
Custom roles created at the tenant level are not restricted to the tenant alone; they can be applied to all child scopes like subscriptions and resource groups within that tenant.
This choice incorrectly limits the scope of assignment to only the tenant and one specific resource group, excluding the subscription level which is a valid scope for tenant-level roles.
This choice incorrectly limits the scope of assignment to only the tenant and one specific subscription, excluding resource groups which are valid scopes for tenant-level roles.
When an Azure custom role is defined at the Azure Active Directory (tenant) scope, it can be assigned to any resource within that tenant's hierarchy. This includes the tenant itself, any management groups, all subscriptions linked to the tenant, and all resource groups and resources within those subscriptions, allowing for broad permission delegation.
Concept tested: Azure custom role scope hierarchy
Source: https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles
Community Discussion
No community discussion yet for this question.