You have an Azure Active Directory (Azure AD) tenant and a root management group. You create 10 Azure subscriptions and add the subscriptions to the root management group. You need to create an…

Question

Options

• AModify the role-based access control (RBAC) role assignments for the root management group.
• BAdd an Azure Policy definition to the root management group.
• CCreate a user assigned identity.
• DCreate a service principal.

• A
  73% (24)
• B
  3% (1)
• C
  6% (2)
• D
  18% (6)

Explanation

Explanation

Modifying the RBAC role assignments for the root management group is the required first step because, by default, no user (including global administrators) has access to create or manage Blueprint definitions at the root management group level - you must explicitly elevate access by assigning yourself the Owner or Blueprint Contributor role at that scope before you can save a definition there.

Why the distractors are wrong:

• Option B (adding a Policy definition) is something you might do within a Blueprint, but it's not a prerequisite for creating the Blueprint definition itself.
• Option C (creating a user-assigned identity) is used for Blueprint assignment (execution), not for creating and storing the definition.
• Option D (creating a service principal) is similarly related to assignment or automation scenarios, not to gaining the access needed to store a definition at the root management group.

Memory Tip: Think of it as "unlock before you build" - the root management group is a highly privileged scope that is locked down by default, so your very first move is always to grant yourself the right RBAC permissions (Owner/Blueprint Contributor) before you can do anything else there.

No community discussion yet for this question.