Exam AZ-500 topic 2 question 47 discussion

A - contoso.com only Azure AD role permissions can't be used in Azure custom roles and vice versa. https://docs.microsoft.com/en-us/azure/active-directory/roles/custom-overview

Answer is D .. once a custom role is assinged to a user, the access can be at any level

When you create a custom role in Azure AD, it is scoped at the directory level (contoso.com) and can only be assigned within the Azure AD tenant. Unlike Azure RBAC roles, which apply to subscriptions, resource groups, and individual resources, Azure AD roles are specific to identity management and directory permissions.

You can use a custom role created for an Azure AD tenant across various scopes within that tenant. Specifically, custom roles can be assigned at the following levels: Tenant level (contoso.com) Resource group level (RG1) Subscription level (Subscription1) Therefore, the correct answer is: D. contoso.com, RG1, and Subscription1

Custom roles in Azure can be scoped to different levels: Azure AD tenant (contoso.com): A role could be scoped to an Azure AD tenant, allowing permissions to be granted at the directory level. Resource Group (RG1): You can also assign roles at the resource group level, allowing permissions to resources within that specific group. Subscription (Subscription1): Similarly, roles can be assigned at the subscription level, applying to all resources in that subscription. In this case, since you created a custom role for the Azure AD tenant contoso.com, it can be used at all levels—contoso.com (Azure AD tenant), RG1 (resource group), and Subscription1 (subscription level). Therefore, D is the most comprehensive option.

Copilot and chatgpt says D

D. contoso.com, RG1, and Subscription1 This is because in Azure, the scope of access for a custom role is at the directory level, and it can be assigned to users, groups, and service principals at subscription, resource group, and resource scopes. Therefore, Role1 can be used for permission delegation not only at contoso.com but also at RG1 and Subscription1.

A contoso.com only. Why? Because the role was created in that tenant and Azure AD roles are a flat hierarchy

I choose A since the current description is : Add permissions for this custom role. Currently, permissions for Application registrations and Enterprise applications are supported in custom roles. It's only possible to assign at the directory level

AzureAD roles can be scoped into Administrative Units-> Application

D. contoso.com, RG1, and Subscription1

there is nothing about RBAC in this question i will choose A

A is the answer. https://learn.microsoft.com/en-us/azure/active-directory/roles/custom-create The role can be assigned either at the directory-level scope or an app registration resource scope only.

A. contoso.com only

delegation

it says that the custom role is created for contoso.com - that its for Azure AD.... if this was asked that a custom role created for subscription than we would have option in a answer list that "Subscription, Resource Group" . Since there is no answer in listed a pair of "Subscription, Resource Group" and I am confident that is question is for Azure AD contoso.com answer : A

It says "custom role" but doesn't elaborate on whether it's an RBAC ROle or an Azure AD Role. Not a valid question as it lacks a critical detail