SC-300 · Question #387
Hotspot Question You have a Microsoft Entra tenant that contains a user named User1. You have an Azure subscription named Sub1. User1 is assigned the Owner role for Sub1. You need to ensure that…
The correct answer is Sub1:: User Access Administrator; Tenant:: Permissions Management Administrator. This question tests knowledge of the minimum required permissions to onboard an Azure subscription to Microsoft Entra Permissions Management, following the principle of least privilege.
Question
Hotspot Question You have a Microsoft Entra tenant that contains a user named User1. You have an Azure subscription named Sub1. User1 is assigned the Owner role for Sub1. You need to ensure that User1 can onboard Sub1 to Permissions Management. The solution must follow the principle of least privilege. Which role should you assign for Sub1, and which role should you assign to User1 for the tenant? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:
Answer Area
- Sub1:User Access AdministratorOwnerReaderSecurity ReaderUser Access Administrator
- Tenant:Permissions Management AdministratorGlobal AdministratorGlobal Secure Access AdministratorPermissions Management AdministratorSecurity Administrator
Explanation
This question tests knowledge of the minimum required permissions to onboard an Azure subscription to Microsoft Entra Permissions Management, following the principle of least privilege.
Approach. For Sub1 (the Azure subscription), you need to assign the 'Contributor' role to the Permissions Management service principal - specifically, you assign the 'Contributor' role at the subscription level to allow Permissions Management to read and manage resources needed for onboarding. For User1 in the Entra tenant, you need to assign the 'Permissions Management Administrator' role (formerly known as Cloud Infrastructure Entitlement Management Administrator), which is the least-privileged Entra role that grants the ability to configure and onboard subscriptions to Permissions Management. Owner on the subscription alone is insufficient for the tenant-level configuration, and Global Administrator would be more than the minimum required.
Concept tested. Microsoft Entra Permissions Management onboarding requirements - specifically, the Azure subscription-level role (Contributor assigned to the Permissions Management app) and the Entra tenant-level role (Permissions Management Administrator) needed to onboard a subscription, following the principle of least privilege.
Reference. https://learn.microsoft.com/en-us/entra/permissions-management/onboard-azure
Topics
Community Discussion
No community discussion yet for this question.