Exam AZ-303 topic 2 question 7 discussion

Actual exam question from Microsoft's AZ-303

Question #: 7
Topic #: 2

You have an Azure Active Directory (Azure AD) tenant linked to an Azure subscription. The tenant contains a group named Admins.
You need to prevent users, except for the members of Admins, from using the Azure portal and Azure PowerShell to access the subscription.
What should you do?

A. From Azure AD, configure the User settings.
B. From Azure AD, create a conditional access policy.
C. From the Azure subscription, assign an Azure policy.
D. From the Azure subscription, configure Access control (IAM).

Show Suggested Answer

Suggested Answer: B 🗳️
Typically, you use Conditional Access to control access to your cloud apps. You can also set up policies to control access to Azure management.
The policy you create applies to all Azure management endpoints, including the following:
✑ Azure portal
✑ Azure Resource Manager provider

Classic Service Management APIs -

✑ Azure PowerShell
✑ Visual Studio subscriptions administrator portal
✑ Azure DevOps
✑ Azure Data Factory portal
To create a policy for Azure management, you select Microsoft Azure Management under Cloud apps when choosing the app to which to apply the policy.

Incorrect Answers:
A: From User Settings you can only restrict access to Azure Portal, not access to Azure Powershell.
Note: Microsoft allows restricting standard user access to Azure Active Directory administration portal.
1. Log in to Azure portal as Global Administrator
2. Go to Azure Active Directory | User Settings
3. Then click on Yes under Restrict access to Azure AD administration portal

Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/conditional-access-azure-management https://www.rebeladmin.com/2019/04/step-step-guide-restrict-azure-ad-administration-portal/

by Bullionaire at Jan. 11, 2021, 2:44 p.m.

Comments

Submit Cancel

inf

Highly Voted 4 years, 6 months ago

Answer: B Conditional Access is correct Active Directory | User settings, has an option to 'Restrict access to the Azure administration portal', though this only applies to non-admins. Also, the information dialog states the following which justifies A not being a correct answer: "No lets a non-administrator use this Azure AD administration portal experience to access Azure AD resources that the user has permission to read, or manage resources they own. Yes restricts all non-administrators from accessing any Azure AD data in the administration portal, but does not restrict such access using PowerShell or another client such as Visual Studio."

upvoted 25 times

J4U

3 years, 11 months ago

Correct. As User settings don't apply for PowerShell, I go with conditional access to restrict the portal access.

upvoted 2 times

...

sfa1

4 years, 5 months ago

Thanks for the extra info, that makes A a no go! https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions#restrict-member-users-default-permissions "Restrict access to Azure AD administration portal Setting this option to No lets non-administrators use the Azure AD administration portal to read and manage Azure AD resources. Yes restricts all non-administrators from accessing any Azure AD data in the administration portal. Note: this setting does not restrict access to Azure AD data using PowerShell or other clients such as Visual Studio."

upvoted 2 times

...

4 years ago

I had this question in the exam that i took on July 14th 2021

upvoted 1 times

4 years, 4 months ago

B is correct https://docs.microsoft.com/en-us/answers/questions/112173/can-we-restrict-azure-portal-httpsportalazurecom-a.html?sort=votes

upvoted 2 times

...

leeuw86

4 years, 5 months ago

I would go for D

upvoted 8 times

kwaazaar

4 years, 4 months ago

Indeed. Why not restrict users all rights on the complete subscription?

upvoted 4 times

pentium75

4 years ago

Because even if user has no access to the subscription, he could have access to a resource in the subscription. Or not? If so, then D would not work. The question here is about blocking access to "the Azure Portal".

upvoted 1 times

...

Load full discussion...