Who Can Create RG1 PIM Eligible Contributor Assignment?

Secure access to resources by using Microsoft Entra ID

Answer For the RG1 PIM eligible Contributor assignment, select Users: Admin2 only and Groups: Group1 and Group2 only.

HOTSPOT Overview Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore. Existing Environment. Network environment The on-premises network contains a datacenter in each office. Existing Environment. Cloud environment Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses. All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table. exhibit The tenant contains the groups shown in the following table. exhibit All devices are enrolled in Microsoft Intune. Existing Environment. Sub1 Resources Sub1 contains a resource group named RG1 that contains the resources shown in the following table. exhibit SQLServer1 uses Microsoft SQL Server authentication. Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets: • Bot Manager 1.1 • Azure-managed Default Rule Set (DRS) Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud: • NIST SP 800-53 Rev. 4 • Microsoft cloud security benchmark (MCSB) • System and Organization Controls (SOC) 2 Type 2 Existing Environment. Sub2 Resources Sub2 contains a resource group named RG2. Planned Changes and Requirements. Planned Changes Fabrikam plans to implement the following changes: • Deploy the following key vaults to RG1: o AKV2 in the West Europe Azure region o AKV3 in the Central US Azure region o AKV4 in the East US Azure region • Deploy the following key vaults to RG2: o AKV5 in the East US region • Configure VM1 to read data from storage1. • Create function apps that have the following hosting plans: o Fa1: Flex Consumption hosting plan o Fa2: Consumption hosting plan o Fa3: Dedicated hosting plan • For WAF1, implement rate limiting rules based on the request location. • Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for Cloud. • Create a new storage account named storage2 that supports Azure Table storage. • Enforce multifactor authentication (MFA) when database administrators access SQLdb1. • Implement ExpressRoute circuits to the on-premises network as shown in the following table. exhibit • For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups. Planned Changes and Requirements. Technical Requirements Fabrikam has the following technical requirements: • If VM1 is deleted, the permissions for VM1 must be removed automatically. • The AKS1 managed identity must only be able to pull images from Registry1. • The ID1 managed identity must be able to push images to and pull images from Registry1. • All the data in the storage accounts must be encrypted by using Fabrikam-managed keys. • All outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits. • ExpressRoute connectivity between the on-premises network and the Azure environment must be encrypted by using Layer 2 or Layer 3 encryption. You need to implement the planned change for the PIM role assignment. Which users can perform the planned change, and for which groups? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. exhibit

Community Insight

The item tests the Azure RBAC permission required to create a PIM eligible Azure-resource role assignment plus the security-group-only target rule; the trap is treating Contributor or Global Administrator as sufficient and assuming Microsoft 365 groups can be assigned.

This SC-500 hotspot tests who can create a PIM eligible Contributor role assignment for resource group RG1 and which groups can receive it. It establishes that Admin2, holding User Access Administrator, is the only permitted user, while only the security groups Group1 and Group2 are valid targets.

Choosing Admin3 because Contributor manages the resource group, or Admin4 because Global Administrator sounds all-powerful; both fail because Azure resource PIM assignments require Owner, User Access Administrator, or RBAC Administrator at the scope, and Global Administrator has no default Azure RBAC access. Another mistake is selecting a Microsoft 365 group instead of a security group.

Community Discussion (2 comments)

MarioMK 👍 1

Users: Admin2 only — User Access Administrator can create PIM assignments for Azure resources. Contributor cannot, and Global Administrator needs to elevate access first. Groups: Group1 and Group2 only — Both are security groups. “Role assignments allowed” applies to Microsoft Entra roles, not Azure resource roles. Microsoft 365 groups aren’t supported.

hwoccurrence 👍 3

Users: Admin2 only. Groups: Group1 and Group2 only. Creating a PIM eligible assignment for an Azure resource role requires permission to write role assignments at the scope (Owner, User Access Administrator or RBAC Administrator), which only Admin2 has on Sub1. Admin3's Contributor role can't grant access, and Admin4's Global Administrator role grants no Azure resource permissions unless access is elevated first. The "role assignments allowed" (isAssignableToRole) setting only applies to Microsoft Entra roles; for Azure resource roles any security group can be assigned, so both Group1 and Group2 qualify. Microsoft 365 groups (Group3 and Group4) can't be assigned Azure RBAC roles, regardless of the role-assignable setting.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Creating a PIM eligible assignment for an Azure resource role is an Azure RBAC write operation at RG1's scope, so the caller must hold Owner, User Access Administrator, or RBAC Administrator there. Admin2 is the only listed administrator with User Access Administrator, which is why the Users selection is Admin2 only. Contributor (Admin3) can manage resources but cannot create role assignments, and Global Administrator (Admin4) has no Azure resource permissions unless elevated. For the Groups selection, PIM for Azure resources targets security groups, so Group1 and Group2 qualify; the Microsoft 365 group does not.

Why Other Candidate Answers Are Wrong

Selecting Admin3 fails because Contributor lacks the role-assignment write permission at RG1, even though it can change the resource group's contents. Selecting Admin4 fails because Global Administrator is a directory role and does not confer Azure RBAC access by default; elevation or an explicit Owner/User Access Administrator assignment is required. Including a Microsoft 365 group fails because Azure resource role assignments are not supported for that group type, and the Entra role-assignable property is not the controlling test for Azure RBAC. Any answer that pairs a valid user with an unsupported group, or a supported group with Admin3/Admin4, is therefore wrong.

Community Comment Notes

hwoccurrence frames the item as a write-permission problem, noting that creating the assignment "requires permission to write role assignments at the scope", which leaves only Admin2. MarioMK agrees with "User Access Administrator can create PIM assignments for Azure resources", adds that Contributor cannot, and notes that Global Administrator must elevate first. On the group side, MarioMK says "Both are security groups" for Group1 and Group2 and explicitly states "Microsoft 365 groups aren’t supported". Those observations match the RBAC and PIM behavior and leave no credible path for Admin3, Admin4, or a Microsoft 365 group.

Official Reference

Exam Strategy

Treat PIM for Azure resources as an Azure RBAC write operation, not an Entra directory-role operation. First eliminate users lacking Owner, User Access Administrator, or RBAC Administrator at RG1, then filter the groups to security groups only.

Frequently Asked Questions

Why can't Admin4, a Global Administrator, create the PIM eligible assignment in RG1?

Global Administrator does not grant Azure resource RBAC permissions by default. Admin4 would need to elevate access or hold Owner/User Access Administrator at RG1; Admin2 already has the required role.

Can a Microsoft 365 group be used for the RG1 PIM Contributor assignment?

No. PIM eligible Azure resource role assignments require security groups, so among the listed groups only Group1 and Group2 are valid targets.

More SC-500 FAQ →

Related Analysis

Practice All SC-500 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SC-500 Practice Test →

← Back to SC-500 Study Guide