Assigning Role Assignment Permissions in Azure Management Groups
You have an Azure management group named MG1 that contains two subscriptions named Sub1 and Sub2. Both subscriptions are linked to a Microsoft Entra tenant that contains a security group named Group1. You need to ensure that the members of Group1 can assign roles to the resources in Sub1 and Sub2. The solution must follow the principle of least privilege. Which role should you assign to Group1?
Community Insight
The question tests the distinction between resource management (Contributor/Owner) and permission delegation (User Access Administrator). The trap is assuming Contributor allows role assignment or that Owner is needed for management groups.
To allow users to assign roles without managing resources, the User Access Administrator role is required. Assigning this at the management group scope ensures least privilege while covering all linked subscriptions.
Learners often select Contributor because it grants broad access, failing to realize that Contributor cannot assign RBAC roles unless explicitly granted User Access Administrator permissions separately.
Community Discussion (2 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The requirement is to allow Group1 members to 'assign roles' to resources. In Azure RBAC, the specific built-in role that grants permission to manage user access (i.e., assign other roles) is User Access Administrator. By assigning this role at the MG1 (Management Group) scope, the permission automatically inherits down to Sub1 and Sub2, satisfying the requirement efficiently. This follows the principle of least privilege because User Access Administrator does not grant permissions to create, modify, or delete the actual resources themselves.Why the Other Options Are Wrong
Contributor (Options A and B) allows full management of resources but explicitly excludes the ability to assign Azure roles. To assign roles, a user needs the User Access Administrator role or the Owner role. Owner (Option D) does include the ability to assign roles, but it also grants full read/write/delete access to all resources. Since the goal is to follow the principle of least privilege and only allow role assignment (not resource modification), Owner is too permissive compared to User Access Administrator.Community Comment Notes
Community consensus correctly identifies User Access Administrator as the key. As Eltooth noted, "The User Access Administrator role explicitly grants the authority to manage user access... It does not grant permissions to create, delete, or modify the actual resources," which perfectly aligns with the least privilege constraint.Official Reference
Exam Strategy
Always look for keywords like 'assign roles' or 'manage access'. If the goal is purely about who can delegate permissions, think 'User Access Administrator'. If the goal includes creating/modifying resources, consider 'Contributor' or 'Owner', weighing them against the least privilege requirement.
Frequently Asked Questions
Why is Contributor not sufficient for assigning roles?
Contributor has full control over resources but lacks the Microsoft.Authorization/roleAssignments/write permission required to assign RBAC roles.
Can I assign User Access Administrator at the subscription level instead?
Yes, but assigning it at the Management Group scope (MG1) is more efficient as it automatically covers all current and future linked subscriptions.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →