Correct Answer: C No one is given default access to the root management group. Azure AD Global Administrators are the only users that can elevate themselves to gain access. Once they have access to the root management group, the global administrators can assign any Azure role to other users to manage it. Reference: https://docs.microsoft.com/en-us/azure/governance/management-groups/overview#important-facts-about-the-root-management-group https://docs.microsoft.com/en-us/azure/governance/management-groups/overview

Ans C: No one is given default access to the root management group. Azure AD Global Administrators are the only users that can elevate themselves to gain access. Once they have access to the root management group, the global administrators can assign any Azure role to other users to manage it.

To ensure that User1 can assign a policy to the tenant root management group, you should choose Option C: Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources. The Global Administrator role in Azure Active Directory has permissions to all administrative features. This role is the most powerful role, and it can assign policies to the tenant root management group. The Owner role for the Azure subscription does not have this level of access. Therefore, options A and B would not meet the requirements. Option D is not relevant as it involves creating a new management group, which is not necessary in this case.

Just verified this. Owner of the subscription is not enough to assign a policy at the root management group. The user needs to have at least the "Microsoft.Authorization/policyAssignments/write"-Permission and probably a couple more read permissions at the root management group. So given the options answer C fulfills this.

C is right

By assigning the Owner role for the Azure subscription to User1, they will have the necessary permissions to manage resources within the subscription, including assigning policies to management groups. Then, instructing User1 to configure access management for Azure resources will allow them to assign policies to the tenant root management group.

It depends. If the subscription is attached to a subgroup manager, the user cannot modify the root group's IAM. If a subscription is attached to the root, the user can modify IAM. If the user is global, then he can gain access across all subscriptions using an "Elevate access" option. I would go with option C because it doesn't say what level the subscription is at. https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal

Correct Answer: C reasoning: becuase

The correct answer is B. Assign the Owner role for the Azure subscription to User1, and then instruct User1 to configure access management for Azure resources12. To assign a policy to the tenant root management group, User1 needs to have the Microsoft.Authorization/roleAssignments/write permission, such as those provided by the Owner role12. Once User1 has the Owner role, they can configure access management for Azure resources, including assigning policies to the tenant root management group12.

Answer should be C

Doc says: The Microsoft official documentation (https://learn.microsoft.com/en-us/azure/governance/management-groups/overview#root-management-group-for-each-directory) says that: "The Azure AD Global Administrator needs to elevate themselves to the User Access Administrator role of this root group initially. " So I would for C but I tryed in lab it doesn't work because Global Administrator can elevate himself to User Access Administrator but the scope of these roles isn't on, or inherited to Tenant Root Management Group so the user1 can't access the overview page of Tenant Root Management Group neither the Access Control (IAM) blade and in this way it'is impossible to him to to assign any policy. The only two possible ways are: 1) Grant User Access Administrator and Resource Policy Contributor to User1 on Tenant Root Management Group 2) Assign Owner role to User1 on Tenant Root Management Group Only After one of these, User1 is able to apply policy to the Tenant Root Management Group.

management groups are on top of subscriptions ! if you set subscription owner rights to a user he will never be able to do anything else besides resources on that subscription C is the only applicable variant here

well the answer for above question is incorrect cuz we are talking about the managment level not the subscription level so i tested it the letter C is the correct answer

Although C is not a recommend practice(in more than 1 way), its the only one that would achieve the goal. Assigning owner role to the subscription wouldn't allow the user to assign policies at the root MG level, which is sitting at a higher hierarchical level than the sub (roughly the same reason why D doesn't work), with C the user can elevate himself to owner or access or policy assigner at root MG level any of which would then allow the user to assign a policy at root MG, that could apply to any MG,RG, Resource and Subscription created under that tenant.

I passed with these questions and many friends passed too, all questions appeared in the real exam a great study resource, contact me on [email protected]

khjfdfhjnkjygjk

I passed with these questions and many friends passed too, if you want real exam questions for twenty only, contact me on [email protected]