Hotspot Question You have an Azure subscription that contains the custom roles shown in the following table. In the Azure portal, you plan to create new custom roles by cloning existing roles. The…

Question

Exhibit

Answer Area

• Role3:
  Role1 onlyBuilt-in Azure AD roles onlyRole1 and built-in Azure AD roles onlyRole1, built-in Azure AD roles, and built-in Azure subscription roles
• Role4:
  Role2 onlyBuilt-in Azure AD roles onlyRole2 and built-in Azure subscription roles onlyRole2, built-in Azure subscription roles, and built-in Azure AD roles

Explanation

This question tests your understanding of Azure RBAC custom role cloning, specifically which existing custom roles can serve as a valid source when creating new custom roles with specific assignable scopes and permissions.

Approach. When cloning a custom role in the Azure portal, the source role must have assignable scopes that are compatible with (i.e., equal to or broader than) the new role's intended assignable scopes. A role can only be cloned if its assignable scopes include the subscription or management group that encompasses the target scope of the new role. Additionally, the cloned role must contain at least the permissions (Actions/NotActions/DataActions) that the new role requires, or you plan to add them - but the key constraint is scope compatibility. For each new role, you select the existing custom role whose assignable scopes overlap with or contain the new role's assignable scopes, ensuring the portal allows the clone operation to proceed without scope violations.

Concept tested. Azure RBAC custom role cloning rules - specifically that the source role's assignable scopes must be compatible with (contain or match) the new role's assignable scopes, and understanding how subscription-level vs. resource-group-level scopes affect which roles can be used as a cloning source.

Reference. https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles#steps-to-create-a-custom-role

No community discussion yet for this question.