Assigning Role Assignment Permissions in Azure Management Groups

SC-500 By islever Editorial Last updated Oct 19, 2026

Secure access to resources by using Microsoft Entra ID

Short answer

C Assign the User Access Administrator role at the MG1 scope to enable role assignment inheritance for Sub1 and Sub2 while adhering to least privilege.

Question

You have an Azure management group named MG1 that contains two subscriptions named Sub1 and Sub2. Both subscriptions are linked to a Microsoft Entra tenant that contains a security group named Group1.
You need to ensure that the members of Group1 can assign roles to the resources in Sub1 and Sub2. The solution must follow the principle of least privilege.
Which role should you assign to Group1?

Contributor at the MG1 scope
Contributor at the Sub1 and Sub2 scopes
User Access Administrator at the MG1 scope Correct Answer
Owner at the MG1 scope

Key Takeaways

The question tests the distinction between resource management (Contributor/Owner) and permission delegation (User Access Administrator). The trap is assuming Contributor allows role assignment or that Owner is needed for management groups.

To allow users to assign roles without managing resources, the User Access Administrator role is required. Assigning this at the management group scope ensures least privilege while covering all linked subscriptions.

Common mistake: Learners often select Contributor because it grants broad access, failing to realize that Contributor cannot assign RBAC roles unless explicitly granted User Access Administrator permissions separately.

Expert Analysis

Why the Answer Is Correct

The requirement is to allow Group1 members to 'assign roles' to resources. In Azure RBAC, the specific built-in role that grants permission to manage user access (i.e., assign other roles) is User Access Administrator. By assigning this role at the MG1 (Management Group) scope, the permission automatically inherits down to Sub1 and Sub2, satisfying the requirement efficiently. This follows the principle of least privilege because User Access Administrator does not grant permissions to create, modify, or delete the actual resources themselves.

Why the Other Options Are Wrong

Contributor (Options A and B) allows full management of resources but explicitly excludes the ability to assign Azure roles. To assign roles, a user needs the User Access Administrator role or the Owner role. Owner (Option D) does include the ability to assign roles, but it also grants full read/write/delete access to all resources. Since the goal is to follow the principle of least privilege and only allow role assignment (not resource modification), Owner is too permissive compared to User Access Administrator.

Community Comment Notes

Community consensus correctly identifies User Access Administrator as the key. As Eltooth noted, "The User Access Administrator role explicitly grants the authority to manage user access... It does not grant permissions to create, delete, or modify the actual resources," which perfectly aligns with the least privilege constraint.

Official Reference

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always look for keywords like 'assign roles' or 'manage access'. If the goal is purely about who can delegate permissions, think 'User Access Administrator'. If the goal includes creating/modifying resources, consider 'Contributor' or 'Owner', weighing them against the least privilege requirement.

Frequently Asked Questions

Why is Contributor not sufficient for assigning roles?

Contributor has full control over resources but lacks the Microsoft.Authorization/roleAssignments/write permission required to assign RBAC roles.

Can I assign User Access Administrator at the subscription level instead?

Yes, but assigning it at the Management Group scope (MG1) is more efficient as it automatically covers all current and future linked subscriptions.

More SC-500 FAQ →

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

Eltooth 👍 2 Answered C

Role Capabilities: The User Access Administrator role explicitly grants the authority to manage user access to Azure resources (assigning Azure roles). It does not grant permissions to create, delete, or modify the actual resources, satisfying the principle of least privilege. Scope Efficiency: Assigning the role at the MG1 scope automatically inherits down to both Sub1 and Sub2 (and any future resources added under MG1). This avoids the administrative overhead of making multiple individual assignments.
AG_245466 👍 1 Answered C

The User Access Administrator role explicitly grants the authority to manage user access to Azure resources (assigning Azure roles). It does not grant permissions to create, delete, or modify the actual resources, satisfying the principle of least privilege.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SC-500 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SC-500 Practice Test →

← Back to SC-500 Study Guide