In Azure, what permissions need to be added to Management Groups to allow Prisma Cloud to calculate net effective permissions?

The correct answer is B. Microsoft.Management/managementGroups/descendants/read. To enable Prisma Cloud to enumerate and read the hierarchy of Azure Management Groups - which is necessary for calculating net effective permissions across an Azure tenant - the service principal must be granted the permission Microsoft.Management/managementGroups/descendants/rea

Cloud Infrastructure Entitlement Management (CIEM)

Question

Options

APaloAltoNetworks.PrismaCloud/managementGroups/*
BMicrosoft.Management/managementGroups/descendants/read
CPaloAltoNetworks.PrismaCloud/managementGroups/descendants/read
DMicrosoft.Management/managementGroups/descendants/calculate

How the community answered

(58 responses)

A
9% (5)
B
72% (42)
C
16% (9)
D
3% (2)

Explanation

To enable Prisma Cloud to enumerate and read the hierarchy of Azure Management Groups - which is necessary for calculating net effective permissions across an Azure tenant - the service principal must be granted the permission Microsoft.Management/managementGroups/descendants/read. This Azure RBAC action allows reading all descendant subscriptions and management groups, giving Prisma Cloud the scope it needs to map inherited and assigned policies. Option A and C are invalid because PaloAltoNetworks.PrismaCloud is not a recognized Azure resource provider namespace used for RBAC on Management Groups. Option D is invalid because 'calculate' is not a valid Azure RBAC action verb for this resource type - Azure uses 'read', 'write', 'action', and 'delete' verbs.

Topics

#Azure Permissions#Management Groups#CIEM#Prisma Cloud Integration

Community Discussion

No community discussion yet for this question.

Full PCCSE Practice