Hotspot Question You have an Azure subscription named Sub1. You plan to deploy Microsoft Entra Permissions Management. You need to ensure that Permission Management can onboard Sub1. The solution…

Question

Answer Area

• PowerShell Command (cmdlet)New-AzRoleAssignment
  New-AzRoleAssignmentNew-AzRoleDefinitionNew-AzTag
• -RoleDefinitionNameOwner
  ContributorOwnerReader

Explanation

This question tests knowledge of the PowerShell commands required to onboard an Azure subscription to Microsoft Entra Permissions Management using the principle of least privilege.

Approach. To onboard an Azure subscription to Microsoft Entra Permissions Management, you need to create a service principal and assign it the correct role. The PowerShell command should use 'New-AzRoleAssignment' to assign the 'Reader' role (not Owner or Contributor) to the Permissions Management service principal at the subscription scope, following least privilege. The correct scope parameter is '/subscriptions/<subscription-id>' and the role definition name should be 'Reader', as Permissions Management only needs read access to discover and analyze permissions. The service principal is identified by its ApplicationId, which corresponds to the Microsoft Entra Permissions Management application (CloudKnox Permissions Management, App ID: b46c3ac5-9da6-418f-a849-0a07a10b3c6c). The command structure is: New-AzRoleAssignment -ApplicationId <PermissionsManagementAppId> -RoleDefinitionName 'Reader' -Scope '/subscriptions/<Sub1-Id>'.

Concept tested. Microsoft Entra Permissions Management onboarding requires assigning the Reader role (least privilege) to the Permissions Management service principal on the target Azure subscription using New-AzRoleAssignment, ensuring only read access is granted for permissions discovery and analysis.

Reference. https://learn.microsoft.com/en-us/azure/active-directory/cloud-infrastructure-entitlement-management/onboard-azure

No community discussion yet for this question.