Correct Answer: C No one is given default access to the root management group. Azure AD Global Administrators are the only users that can elevate themselves to gain access. Once they have access to the root management group, the global administrators can assign any Azure role to other users to manage it. Reference: https://docs.microsoft.com/en-us/azure/governance/management-groups/overview#important-facts-about-the-root-management-group https://docs.microsoft.com/en-us/azure/governance/management-groups/overview

Ans C: No one is given default access to the root management group. Azure AD Global Administrators are the only users that can elevate themselves to gain access. Once they have access to the root management group, the global administrators can assign any Azure role to other users to manage it.

Although C is not a recommend practice(in more than 1 way), its the only one that would achieve the goal. Assigning owner role to the subscription wouldn't allow the user to assign policies at the root MG level, which is sitting at a higher hierarchical level than the sub (roughly the same reason why D doesn't work), with C the user can elevate himself to owner or access or policy assigner at root MG level any of which would then allow the user to assign a policy at root MG, that could apply to any MG,RG, Resource and Subscription created under that tenant.

I passed with these questions and many friends passed too, all questions appeared in the real exam a great study resource, contact me on [email protected]

khjfdfhjnkjygjk

I passed with these questions and many friends passed too, if you want real exam questions for twenty only, contact me on [email protected]

The answer B is correct. The mistake most people are making is that they are not taking note of the scenario, Azure subscription is mentioned not Azure AD. Owner's role is an Azure subscription role while Global Admin is more of an Azure AD role.

bc playing with Root

Explanation: In Azure, permissions and access control are often managed through management groups and role assignments. The tenant root management group is the highest level in the Azure hierarchy, and you need to delegate permissions at this level. Assigning the Owner role at the Azure subscription level (options A and B) or assigning the Global administrator role (option C) would not directly grant User1 the necessary permissions to manage policies at the tenant root management group level. Creating a new management group and delegating User1 as the owner of that management group allows User1 to have the necessary permissions to manage policies at that level without giving them excessive privileges over the entire Azure subscription or tenant. So, the correct answer is option D.

C is correct!

Correct Answer is C-

Correct Answer: B Because the user 1 is already part of the tenant group, if we need to create a new user / assign roles for tenant means we use Global Administrator role. But here we only assign policy.

Assigning someone as Owner to a Subscription gives them full control ONLY to that subscription. The question requires that the person touches the Root Management Group. Only an AAD Global Administrator has the permissions to do so. So answer is C.

https://docs.microsoft.com/en-us/azure/governance/management-groups/overview#important-facts-about-the-root-management-group Once User1 is elevated to Owner of the tenant, they can manage the policies. The Azure Subscription Owner need not be a global admin of Azure AD.

after everything i will go again with c, can't be anything else...

now, when i think about a bit, if we have subscription, we are probably global admin user0, and we have to assign something to user1, if we assign something to user1, then maybe it is b in the end, can someone clarify more, im feeling dizzy

I thought I read on learn ms that ONLY global admin can do that