AZ-305 Practice Question 31: Scoped Permission Model
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 4 · question 1 of 10
A platform team governs 40 subscriptions that all sit under a single management group. The network operations team needs to create and modify route tables, network security groups, and virtual network peerings anywhere in that estate, and to read every other resource type. The design must also ensure that:
- the network operations team cannot delete a virtual network, - the permission set is defined once and is assignable across all 40 subscriptions, including subscriptions added later, - the team is granted nothing beyond what it needs.
What should you include in the design?
Show answer and explanation
Answer:
Custom roles exist for exactly this case, when the built-in roles do not meet the specific needs of the organization. The typical approach is to start from an existing built-in role and adjust it, adding the permitted operations to Actions and the operations to carve out to NotActions. A custom role can be assigned at management group, subscription, and resource group scope, and listing the management group in AssignableScopes means one definition covers every subscription beneath it, including subscriptions added later through inheritance.
Option A is one clean assignment that grants too much. Network Contributor covers the networking resource provider broadly, including deleting virtual networks, so it violates the requirement the scenario was written around.
Option B abandons least privilege entirely. Contributor grants control of nearly every resource type in all 40 subscriptions, and an activity log alert reports a deletion after it has happened, detection, not prevention.
Option D fails on effort and on correctness. It still hands out Network Contributor, so virtual networks remain deletable inside those resource groups, and it turns one assignment into an open-ended list that must be maintained by hand every time a resource group is created.
Reference: Azure custom roles