Which RBAC Role Should You Assign to Enable Resource Group Management?

Correct Answer: D

You should assign the new employee the Contributor RBAC-role on the Azure resource group he is to manage.

Option A is incorrect.

This will give the user access to manage all aspects within the subscription AND assign roles within the subscription.

The user should only manage one resource group.

Option B is incorrect.

This will give the user access to manager AND assign roles within the resource group.

This is not permitted.

Option C is incorrect.

This will give the user access to manage all aspects within the subscription.

The user should only manage one resource group.

To know more about the built-in RBAC roles, please refer to the link below:

RBAC (Role-Based Access Control) is a security methodology that enables administrators to manage permissions and access to resources in Azure. When a user is assigned an RBAC role, it provides a set of permissions that allow the user to perform specific actions within Azure resources.

In this scenario, the IT administrator needs to enable a new employee to manage and create all resources within a particular resource group, but restrict the employee from granting access to others to the same resource group or resources within it.

To achieve this, the IT administrator should assign the Contributor role on the resource group level (Option D) to the new employee.

Option A - Owner role on the subscription level is not recommended because it would give the employee excessive permissions to manage all resources and resource groups within the subscription.

Option B - Owner role on the resource group level would provide the employee with full control over the resource group and its resources, which includes permissions to grant access to others.

Option C - Contributor role on the subscription level would provide the employee with access to manage resources across all resource groups in the subscription, which is not what is required.

Therefore, option D is the best solution as it provides the employee with necessary permissions to manage and create resources within a specific resource group, but limits their ability to grant access to others to the same resource group or resources within it.