SC-300 · Question #350
Hotspot Question You have an Azure subscription named Sub1. You plan to use Microsoft Entra Permissions Management to manage Sub1. You need to ensure that Permissions Management can perform the…
The correct answer is Role: Access Review Operator Service Role; Use: An Autopilot rule. This question tests knowledge of Microsoft Entra Permissions Management integration with Azure, specifically the minimum required roles and the correct tool for providing recommendations and removing unused permissions.
Question
Hotspot Question You have an Azure subscription named Sub1. You plan to use Microsoft Entra Permissions Management to manage Sub1. You need to ensure that Permissions Management can perform the following tasks:
- Identify unused permissions assigned to applications and managed
identities.
- Provide users with recommendations about which permissions to remove.
- Remove unused permissions.
The solution must follow the principle of least privilege. Which role should you assign to the service principal of Permissions Management, and what should you use to provide recommendations and remove unused permissions? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:
Answer Area
- RoleAccess Review Operator Service RoleAccess Review Operator Service RoleOwnerReaderUser Access Administrator
- UseAn Autopilot ruleA custom reportA role templateAn audit queryAn Autopilot rule
Explanation
This question tests knowledge of Microsoft Entra Permissions Management integration with Azure, specifically the minimum required roles and the correct tool for providing recommendations and removing unused permissions.
Approach. For the service principal of Permissions Management to identify unused permissions on Azure resources (applications and managed identities), it needs the 'Reader' role at the subscription level - this is the least privileged role that allows it to read all resource configurations and assigned permissions without modifying anything. To provide recommendations and actually remove unused permissions, you use the 'Permissions Management' portal (Entra Permissions Management dashboard/UI) which leverages the 'User Access Administrator' role assigned to the Permissions Management service principal - this role allows it to modify role assignments and remove unused permissions. Therefore: (1) Assign 'Reader' role to the Permissions Management service principal for discovery/identification, and assign 'User Access Administrator' for the ability to remove permissions. (2) Use the Permissions Management portal (right-sizing recommendations feature) to provide recommendations and execute the removal of unused permissions, following least privilege by only granting the roles needed for each specific task.
Concept tested. Microsoft Entra Permissions Management (formerly CloudKnox) requires specific Azure RBAC roles assigned to its service principal: 'Reader' for discovery of unused permissions (least privilege for read-only scanning), and 'User Access Administrator' for the ability to remediate/remove those permissions. The Permissions Management portal is the correct interface for surfacing recommendations and executing right-sizing actions, rather than tools like Azure Policy or Azure Advisor.
Reference. https://learn.microsoft.com/en-us/entra/permissions-management/onboard-azure
Topics
Community Discussion
No community discussion yet for this question.