You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a resource group named RG1.
A user named User1 has the following roles for Subscription1:
• Reader
• Security Admin
• Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users.
What should you do?
To ensure that User1 can assign the Reader role for VNet1 to other users, User1 needs to have permissions to manage access to Azure resources, which includes role assignments. The User Access Administrator role is specifically designed for this purpose, as it allows the management of user access to Azure resources. Therefore, assigning User1 the User Access Administrator role for VNet1 is the correct action.
This question has already appeared multiple times
Three of the answers involve assigning a Contributor role. Contributor does not include the ability to assign rights, permissions, or roles. Therefore the correct answer has to be C, assign the User Access Admin role.
Network Contributor - Lets you manage networks, but not access to them. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#network-contributor User Access Administrator - Lets you manage user access to Azure resources. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator Contributor - Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries. T2Q71 - similar question with another possible solution - Assign User1 the Owner role for VNet1.
Assigning roles to users is at least User Access Administrator
correcta
To allow User1 to assign the Reader role for VNet1 to other users, User1 needs to have permissions related to Azure RBAC (Role-Based Access Control). Among the listed options: A. Assign User1 the Contributor role for VNet1. - The Contributor role allows a user to manage everything except access. B. Assign User1 the Network Contributor role for VNet1. - This role provides permissions to manage networking resources, not role assignments. C. Assign User1 the User Access Administrator role for VNet1. - This role provides permissions to manage user access to Azure resources, which means User1 can assign roles to other users for VNet1. D. Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1. - This does not directly provide User1 with permissions to manage user access. The correct action is: C. Assign User1 the User Access Administrator role for VNet1.
C. Assign User1 the User Access Administrator role for VNet1.