Exam AZ-104 topic 2 question 76 discussion

B is correct, You need to have the Owner Role or Access Administrator role to assign roles but Access Administrator role is preferred as it is least privilege. https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles

Shouldn't this be "User" Access Administrator?

B is correct

A: Removing Security Reader won't grant additional permissions for assigning roles. Contributor for RG1 only manages resources within the group, not role assignment. C: Removing Reader and Security Reader is unnecessary and removes existing access. Additionally, Contributor for Subscription1 is too broad and grants too many privileges. D: Network Contributor only manages network resources like subnets and load balancers, not role assignment for VNet1. The Access Administrator role specifically grants the "Microsoft.Authorization/roleAssignments/write" permission, which allows adding and removing role assignments, including assigning the Reader role for VNet1 to other users. This role provides the exact capability required without granting excessive permissions. Therefore, B. Assign User1 the Access Administrator role for VNet1 is the correct solution to enable User1 to assign the Reader role for VNet1 to other users.

I would go for the B

To ensure that User1 can assign the Reader role for VNet1 to other users, you should assign User1 the Network Contributor role for RG1. The Network Contributor role allows users to manage network resources, including virtual networks and their associated resources. By assigning User1 the Network Contributor role for RG1, they will have the necessary permissions to assign the Reader role for VNet1 to other users within the same resource group. Therefore, the correct option is: D. Assign User1 the Network Contributor role for RG1.

For a user to assign roles he needs to have the Owner role or Access Administrator role. In this case, B is the only viable answer.

Selected Answer: B

You need User Administrator Role for assigning the Reader role to User1 for VNet1

B. Assign User1 the Access Administrator role for VNet1.