a successful password reset depends on available verification methods satisfying the configured policy. In this case, a pilot group should test password self-service before company-wide rollout. “SSPR authentication-method registration and policy requirements” would not satisfy that requirement; the supported action is “Enable SSPR for the selected pilot group”. A group-scoped rollout limits impact while registration and help-desk procedures are evaluated.

registration makes the required identity verification data available before the next password-recovery event. In this case, a pilot group should test password self-service before company-wide rollout. “Require or encourage registration for SSPR authentication methods” would not satisfy that requirement; the supported action is “Enable SSPR for the selected pilot group”. A group-scoped rollout limits impact while registration and help-desk procedures are evaluated.

invitation acceptance does not automatically grant authorization to every application or resource. In this case, a pilot group should test password self-service before company-wide rollout. “The guest's app assignments and group-based permissions” would not satisfy that requirement; the supported action is “Enable SSPR for the selected pilot group”. A group-scoped rollout limits impact while registration and help-desk procedures are evaluated.

registration makes the required identity verification data available before the next password-recovery event. In this case, a user cannot complete self-service reset because no registered verification method is available. “Require or encourage registration for SSPR authentication methods” would not satisfy that requirement; the supported action is “SSPR authentication-method registration and policy requirements”. A successful password reset depends on available verification methods satisfying the configured policy.

a group-scoped rollout limits impact while registration and help-desk procedures are evaluated. In this case, a user cannot complete self-service reset because no registered verification method is available. “Enable SSPR for the selected pilot group” would not satisfy that requirement; the supported action is “SSPR authentication-method registration and policy requirements”. A successful password reset depends on available verification methods satisfying the configured policy.

sSPR provides a controlled user-initiated reset process according to registration and authentication policy. In this case, a user cannot complete self-service reset because no registered verification method is available. “Microsoft Entra self-service password reset” would not satisfy that requirement; the supported action is “SSPR authentication-method registration and policy requirements”. A successful password reset depends on available verification methods satisfying the configured policy.

a successful password reset depends on available verification methods satisfying the configured policy. In this case, a help desk receives many reset calls from eligible users who never enrolled. “SSPR authentication-method registration and policy requirements” would not satisfy that requirement; the supported action is “Require or encourage registration for SSPR authentication methods”. Registration makes the required identity verification data available before the next password-recovery event.

sSPR provides a controlled user-initiated reset process according to registration and authentication policy. In this case, a help desk receives many reset calls from eligible users who never enrolled. “Microsoft Entra self-service password reset” would not satisfy that requirement; the supported action is “Require or encourage registration for SSPR authentication methods”. Registration makes the required identity verification data available before the next password-recovery event.

an invitation establishes a guest representation for cross-tenant collaboration. In this case, a help desk receives many reset calls from eligible users who never enrolled. “Send a guest invitation to the external identity” would not satisfy that requirement; the supported action is “Require or encourage registration for SSPR authentication methods”. Registration makes the required identity verification data available before the next password-recovery event.

contributor permits resource management but does not normally allow changing Azure role assignments. In this case, a support analyst needs to view resource configuration without changing it. “Contributor at the VM's resource scope” would not satisfy that requirement; the supported action is “Reader at the intended resource scope”. Reader provides management-plane read access while avoiding general modification permission.

this role focuses on RBAC assignment management at the designated scope. In this case, a support analyst needs to view resource configuration without changing it. “Role Based Access Control Administrator at the resource group” would not satisfy that requirement; the supported action is “Reader at the intended resource scope”. Reader provides management-plane read access while avoiding general modification permission.

resource-group scope restricts effective management permissions to resources under that group. In this case, a support analyst needs to view resource configuration without changing it. “Assign an appropriate role at the test resource-group scope” would not satisfy that requirement; the supported action is “Reader at the intended resource scope”. Reader provides management-plane read access while avoiding general modification permission.

reader provides management-plane read access while avoiding general modification permission. In this case, an operations engineer must manage a VM but must not grant other people RBAC permissions. “Reader at the intended resource scope” would not satisfy that requirement; the supported action is “Contributor at the VM's resource scope”. Contributor permits resource management but does not normally allow changing Azure role assignments.

resource-group scope restricts effective management permissions to resources under that group. In this case, an operations engineer must manage a VM but must not grant other people RBAC permissions. “Assign an appropriate role at the test resource-group scope” would not satisfy that requirement; the supported action is “Contributor at the VM's resource scope”. Contributor permits resource management but does not normally allow changing Azure role assignments.

an assignment at a management group propagates to descendants, avoiding separate subscription assignments. In this case, an operations engineer must manage a VM but must not grant other people RBAC permissions. “Assign Reader at the common management-group scope” would not satisfy that requirement; the supported action is “Contributor at the VM's resource scope”. Contributor permits resource management but does not normally allow changing Azure role assignments.

resource-group scope restricts effective management permissions to resources under that group. In this case, an administrator must delegate management of role assignments at a resource group. “Assign an appropriate role at the test resource-group scope” would not satisfy that requirement; the supported action is “Role Based Access Control Administrator at the resource group”. This role focuses on RBAC assignment management at the designated scope.

reader provides management-plane read access while avoiding general modification permission. In this case, an administrator must delegate management of role assignments at a resource group. “Reader at the intended resource scope” would not satisfy that requirement; the supported action is “Role Based Access Control Administrator at the resource group”. This role focuses on RBAC assignment management at the designated scope.

owner combines resource management permissions with authority to delegate RBAC access at the selected scope. In this case, an administrator must delegate management of role assignments at a resource group. “Owner scoped to that subscription” would not satisfy that requirement; the supported action is “Role Based Access Control Administrator at the resource group”. This role focuses on RBAC assignment management at the designated scope.

least privilege pairs the needed operation with the smallest resource and action scope. In this case, a platform owner must manage resources and delegate access across one subscription. “A narrowly scoped role granting the required VM action” would not satisfy that requirement; the supported action is “Owner scoped to that subscription”. Owner combines resource management permissions with authority to delegate RBAC access at the selected scope.

this role focuses on RBAC assignment management at the designated scope. In this case, a platform owner must manage resources and delegate access across one subscription. “Role Based Access Control Administrator at the resource group” would not satisfy that requirement; the supported action is “Owner scoped to that subscription”. Owner combines resource management permissions with authority to delegate RBAC access at the selected scope.

contributor permits resource management but does not normally allow changing Azure role assignments. In this case, a platform owner must manage resources and delegate access across one subscription. “Contributor at the VM's resource scope” would not satisfy that requirement; the supported action is “Owner scoped to that subscription”. Owner combines resource management permissions with authority to delegate RBAC access at the selected scope.

owner combines resource management permissions with authority to delegate RBAC access at the selected scope. In this case, an auditor should inspect only one storage account's management settings. “Owner scoped to that subscription” would not satisfy that requirement; the supported action is “At that storage account rather than the entire subscription”. Narrowly scoping a role prevents unrelated resources from inheriting unnecessary read access.

this role focuses on RBAC assignment management at the designated scope. In this case, an auditor should inspect only one storage account's management settings. “Role Based Access Control Administrator at the resource group” would not satisfy that requirement; the supported action is “At that storage account rather than the entire subscription”. Narrowly scoping a role prevents unrelated resources from inheriting unnecessary read access.

an assignment at a management group propagates to descendants, avoiding separate subscription assignments. In this case, an auditor should inspect only one storage account's management settings. “Assign Reader at the common management-group scope” would not satisfy that requirement; the supported action is “At that storage account rather than the entire subscription”. Narrowly scoping a role prevents unrelated resources from inheriting unnecessary read access.

this role focuses on RBAC assignment management at the designated scope. In this case, a developer needs rights for one test resource group but not production. “Role Based Access Control Administrator at the resource group” would not satisfy that requirement; the supported action is “Assign an appropriate role at the test resource-group scope”. Resource-group scope restricts effective management permissions to resources under that group.

contributor permits resource management but does not normally allow changing Azure role assignments. In this case, a developer needs rights for one test resource group but not production. “Contributor at the VM's resource scope” would not satisfy that requirement; the supported action is “Assign an appropriate role at the test resource-group scope”. Resource-group scope restricts effective management permissions to resources under that group.

an assignment at a management group propagates to descendants, avoiding separate subscription assignments. In this case, a developer needs rights for one test resource group but not production. “Assign Reader at the common management-group scope” would not satisfy that requirement; the supported action is “Assign an appropriate role at the test resource-group scope”. Resource-group scope restricts effective management permissions to resources under that group.

resource-group scope restricts effective management permissions to resources under that group. In this case, a new central operations team must read all resources across several subscriptions beneath one management group. “Assign an appropriate role at the test resource-group scope” would not satisfy that requirement; the supported action is “Assign Reader at the common management-group scope”. An assignment at a management group propagates to descendants, avoiding separate subscription assignments.

reader provides management-plane read access while avoiding general modification permission. In this case, a new central operations team must read all resources across several subscriptions beneath one management group. “Reader at the intended resource scope” would not satisfy that requirement; the supported action is “Assign Reader at the common management-group scope”. An assignment at a management group propagates to descendants, avoiding separate subscription assignments.

this role focuses on RBAC assignment management at the designated scope. In this case, a new central operations team must read all resources across several subscriptions beneath one management group. “Role Based Access Control Administrator at the resource group” would not satisfy that requirement; the supported action is “Assign Reader at the common management-group scope”. An assignment at a management group propagates to descendants, avoiding separate subscription assignments.

owner combines resource management permissions with authority to delegate RBAC access at the selected scope. In this case, a security analyst only needs to restart a particular VM and must not receive broad subscription privileges. “Owner scoped to that subscription” would not satisfy that requirement; the supported action is “A narrowly scoped role granting the required VM action”. Least privilege pairs the needed operation with the smallest resource and action scope.

resource-group scope restricts effective management permissions to resources under that group. In this case, a security analyst only needs to restart a particular VM and must not receive broad subscription privileges. “Assign an appropriate role at the test resource-group scope” would not satisfy that requirement; the supported action is “A narrowly scoped role granting the required VM action”. Least privilege pairs the needed operation with the smallest resource and action scope.

this role focuses on RBAC assignment management at the designated scope. In this case, a security analyst only needs to restart a particular VM and must not receive broad subscription privileges. “Role Based Access Control Administrator at the resource group” would not satisfy that requirement; the supported action is “A narrowly scoped role granting the required VM action”. Least privilege pairs the needed operation with the smallest resource and action scope.