AZ-104 Practice Question 12: Custom Role Assignable Scopes
Microsoft Azure Administrator Associate (AZ-104) · Test 2 · question 2 of 10
You are authoring a custom role for a storage operations team. The definition contains several control-plane Actions, one DataActions entry (Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read), and an AssignableScopes array that lists two management groups: /providers/Microsoft.Management/managementGroups/mg-corp and /providers/Microsoft.Management/managementGroups/mg-sandbox.
Creating the role definition fails. Which change lets the role be created and assigned as broadly as the platform allows?
Show answer and explanation
Answer:
Two documented limits collide here. First, "you can define only one management group in AssignableScopes of a custom role"; listing two is what makes the definition invalid. Second, "custom roles with DataActions can't be assigned at the management group scope." Microsoft calls out the exact workaround: create the role with DataActions and one management group in AssignableScopes, then assign it at the scope of the subscriptions within that management group.
Option A is explicitly prohibited: "You cannot set AssignableScopes to the root scope ("/")." Only built-in roles are assignable at that scope.
Option C is prohibited for the same safety reason: "You cannot use wildcards (*) in AssignableScopes." Wildcards are allowed in action strings, not in scopes, so that a role definition can never silently widen the scopes it applies to.
Option D breaks the role. Data-plane permissions such as reading blob content must be declared in DataActions; putting the string in Actions grants nothing on the data plane. It also does not address the one-management-group limit, which is what caused the failure.
Reference: Azure custom roles