You have an Azure subscription. You need to use Microsoft Entra Permissions Management to automatically monitor permissions and create and implement right-size roles. The solution must follow the…

Question

Options

• AUser Access Administrator
• BContributor
• CReader
• DOwner

• A
  71% (44)
• B
  10% (6)
• C
  15% (9)
• D
  5% (3)

Explanation

Explanation

User Access Administrator (A) is correct because Microsoft Entra Permissions Management requires the ability to read existing role assignments and create/implement new right-sized roles on the service principal's behalf. User Access Administrator grants precisely this - the ability to manage user access (role assignments) to Azure resources - without providing unnecessary resource management capabilities, aligning with least privilege.

Contributor (B) is wrong because it allows creating and managing Azure resources but cannot manage role assignments, which is the core requirement here. Reader (C) is wrong because it is read-only and cannot create or implement any role assignments at all, making it insufficient for the "implement" part of the requirement. Owner (D) is wrong because while it would technically work, it grants full control over resources and access - far exceeding what Permissions Management needs and violating the principle of least privilege.

Memory Tip: Think of "User Access Administrator" as the Goldilocks role for access management tasks - it's not too broad (Owner), not resource-focused (Contributor), and not too limited (Reader). Whenever a task involves managing role assignments specifically, User Access Administrator is almost always your least-privilege answer.

No community discussion yet for this question.