Exam AZ-104 topic 2 question 61 discussion

A) " Select the custom role and add Sub1 and Sub2 to the assignable scopes. Remove RG1 from the assignable scopes. " To assure the solution minimizes the administrative effort, we just need to change the assignable scope list of the custom role. Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles#custom-role-properties

To ensure that you can apply the custom role to any resource group in Sub1 and Sub2 while minimizing administrative effort, you should select the custom role and add both Sub1 and Sub2 to the assignable scopes. In the Azure portal, navigate to the custom role that has been created and click on it. By adding both Sub1 and Sub2 to the assignable scopes of the custom role, you can ensure that the role can be applied to any resource group in both subscriptions. This minimizes administrative effort by eliminating the need to create separate custom roles for each subscription. Option B is not recommended as it would require creating a separate custom role for each subscription, which would increase administrative effort. Option C is not recommended as it would only allow the custom role to be applied to resource groups in Sub1 and not Sub2. Option D is not recommended as it would require creating a separate custom role for Sub2, which would increase administrative effort.

The correct answer is: A. Select the custom role and add Sub1 and Sub2 to the assignable scopes. Remove RG1 from the assignable scopes. Why not the other options? B. Create two separate custom roles ➤ More effort than necessary. You're duplicating work by creating and managing two roles. C. A single role with Sub1 and Sub2 in the scope ➤ Sounds okay, but "Create a new role" is unnecessary if you can just update the existing one. D. Create a second custom role just for Sub2 ➤ Again, this increases administrative overhead instead of updating one role.

Finally, the community 100% agreed on a Correct answer.

ChatGPT4 says A

A. Select the custom role and add Sub1 and Sub2 to the assignable scopes. Remove RG1 from the assignable scopes.

An easy way to remember this is that B, C, D all require to "create new custom roles". The question is asking you to minimize administrative effort. Answer A is the only outlier.

A is correct

a) "Custom roles can be shared between subscriptions that trust the same Microsoft Entra tenant" it mean we can use the same custom role in sub1 and sub2. https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles

C. Option

Is Azure Custom Role a property of a subscription? or it sits above all subscriptions?

Answer is correct

A is the answer. https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles If the Azure built-in roles don't meet the specific needs of your organization, you can create your own custom roles. Just like built-in roles, you can assign custom roles to users, groups, and service principals at management group (in preview only), subscription, and resource group scopes. Custom roles can be shared between subscriptions that trust the same Azure AD tenant.

The correct answer is A.

Correct Answer is A for sure

Correct Answer: A

The answer is correct:A