Exam AZ-103 topic 1 question 12 discussion

Yes, No, No since only Admin1 elevated his access to global admin

This question is outdated, most likely. Either that, or the answer is simply wrong. Admin2 would NOT be able to set Admin1 as subscription Owner. The "Global Admin can manage Azure Subscriptions [...]" setting applies only to the logged admin, it is not a global setting. That said, without the Owner nor the User Access Administrator roles, Admin2 would not even be able to see the subscription, even less manage RBAC for it.

While setting the tenant by Admin1, he/she selected "Global admin can manage subsciption and management groups" as yes. So second answer is Yes, and the final answer is YYN.

As a Global Administrator in Azure Active Directory (Azure AD), you might not have access to all subscriptions and management groups in your directory. When you elevate your access, you will be assigned the User Access Administrator role in Azure at root scope (/). This allows you to view all resources and assign access in any subscription or management group in the directory. User Access Administrator role assignments can be removed using Azure PowerShell, Azure CLI, or the REST API. You should remove this elevated access once you have made the changes you need to make at root scope. https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin answer is yes no no

YYY should be correct as all are global admins and can can do all operations.

The answer is correct. It's a little bit tricky that Admin1, Admin2 and Admin3 are all globle admins, and the other informations are all disturbance terms. Here should be clear that globle admin can only modify roles other than any resource changings.

Y N N Tested myself.

Exam Question 12/23/2020

Correct Answer: Yes, Yes, No

I don't get this solution... Isn't Admin 3 the owner? Wouldn't it be an incredible flaw if other global admins could somehow conspire to kick him out of ownership?

YYY as global admin

YNN. https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin

Having tested this actual scenario, the answer is Yes, Yes and Yes....

came 28th Aug

Correct Answer: YYN

Y Y Y This is correct answer

Does it make any difference the Global Admins are at tenant level? This may or may not help... :) https://www.netsurit.com/en-za/elevate-access-for-azure-ad-global-admin-to-manage-all-azure-subscriptions/