SC-500 — Frequently Asked Questions

Global Admin does not automatically become a mandatory PIM approver; the role's Require approval setting is disabled, so eligible users activate without an approval request.

No. Activation maximum controls how long an activated role session lasts; Expire active assignments is a separate setting and can be shortened to two days.

An Entra admin enables Microsoft Entra logins, but SQL logins and SQL authentication remain available unless Entra-only authentication is enabled on the logical server.

Yes. It is a logical-server-level setting that blocks SQL authentication for all databases on Server1, rather than requiring a per-database change in DB1.

Encryption scopes apply to Blob containers and Azure Files, not Azure Table storage, so table data would not be covered by the Fabrikam-managed key.

Yes. At the storage-account level you select customer-managed keys stored in Azure Key Vault, which makes the account encryption key Fabrikam-managed.

It is a control-plane role for managing the storage account itself, not a data-plane role for blob contents, so it does not grant the required read/write/delete blob actions.

Container scope grants only the needed data access on that container, while account scope would also cover every other container and violate least privilege.

VNet1 is the provider VNet that owns VM1 and VM2, so it publishes them through a Private Link service. The consumer VNet2 then creates the private endpoint that VM3 uses.

No. Peering connects the VNets broadly and does not provide per-service scoping, whereas Private Link exposes only the specific service behind the Private Link service.

They can coexist; adding a shared user-assigned identity does not remove the existing system-assigned identities, and that shared identity can be granted an RBAC role on storage1.

Yes. To let the managed identity read blob data, assign a data-plane role like Storage Blob Data Reader; management-plane roles such as Reader do not grant blob data access.

Azure RBAC assigns roles to security principals; a system-assigned managed identity is a separate service principal tied to the VM, not the VM resource object itself.

No. Network access only makes the storage endpoint reachable; managed identity authentication still requires a data-plane role such as Storage Blob Data Reader on storage1.

The VM resource is not a security principal. To grant access, assign the storage role to the VM's system-assigned managed identity service principal, or add that service principal to the group.

No. Public network access only affects connectivity; authentication and authorization still require a valid identity and an appropriate Azure RBAC role assignment.

App Service protection monitors Azure App Service web apps and API apps; it has no Kubernetes control-plane or node visibility, so it cannot protect AKS1.

No. It also covers node and workload runtime threats, vulnerability assessment, container registry images, and Kubernetes posture recommendations.

Bastion accepts HTTPS sessions from the Azure portal or Internet on 443 and proxies RDP; 3389 is used outbound from the Bastion subnet to the target VM, not inbound from the Internet.

Only if you need SSH access to Linux VMs; for RDP the outbound rule is TCP 3389. Microsoft's Bastion NSG guidance also includes other required rules such as Gateway Manager access.

Containers in the same ACI container group share localhost, so internal traffic to port 5000 does not depend on the group's public port list.

No. ACI publishes only the ports declared for the container group's public IP, so omitting TCP 5000 removes external reachability without an NSG rule.

NSG rules are static: once created they stay in effect until edited or deleted, so they cannot automatically expire RDP access after four hours the way a JIT request does.

No. Bastion removes the public RDP endpoint by brokering connections over TLS, but it does not automatically close or expire the underlying access after a set period; you would still need a time-bound control such as JIT.

Global Administrator does not grant Azure resource RBAC permissions by default. Admin4 would need to elevate access or hold Owner/User Access Administrator at RG1; Admin2 already has the required role.

No. PIM eligible Azure resource role assignments require security groups, so among the listed groups only Group1 and Group2 are valid targets.