Hotspot Question You have an Azure subscription that contains the resources shown in the following table. You perform the following tasks: - Create a managed identity named Managed1. - Create a…

Question

Exhibit

Answer Area

• Service Principles:
  App1 onlyManaged1 and VM1 onlyManaged1, VM1, and App1 onlyManaged1, VM1, App1, and Group1
• Identities:
  App1 onlyManaged1 and VM1 onlyManaged1, VM1, and App1 onlyManaged1, VM1, App1, and Group1

Explanation

This question tests understanding of which Azure AD objects create service principals and which identity types can be assigned Azure RBAC roles like Reader on a resource group.

Approach. Service principals are created for: App1 (enterprise application registrations always create a service principal in the tenant) and VM1's system-assigned managed identity (system-assigned managed identities create a service principal tied to the resource's lifecycle). Managed1 (user-assigned managed identity) also creates a service principal. Group1 (Microsoft 365 group) does NOT create a service principal - it is a directory group, not a service principal. For assigning the Reader role on RG1, Azure RBAC supports: users, groups (including Microsoft 365 groups like Group1), service principals, and managed identities. Therefore Managed1, Group1, App1, and VM1's system-assigned managed identity can ALL be assigned the Reader role for RG1. The key distinction is that service principals are created by app registrations and managed identities, while Microsoft 365 groups are directory objects that can still receive RBAC role assignments without being service principals.

Concept tested. Understanding the difference between Azure AD service principals (created by app registrations and managed identities) versus directory groups, and which identity types support Azure RBAC role assignments on resource groups.

Reference. https://learn.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals

No community discussion yet for this question.