a child-scope contributor assignment does not extend full write access to other subscription resources. In this case, a user loses one group membership but keeps inherited subscription Reader access. “Contributor rights apply to that VM while Reader applies elsewhere” would not satisfy that requirement; the supported action is “An independent ancestor-scope assignment still applies”. Removing a lower-scope assignment cannot revoke a separate role granted higher in the hierarchy.

reader alone cannot delete resources, so a separate additive assignment likely permits the action. In this case, a user loses one group membership but keeps inherited subscription Reader access. “All effective roles from user, group and ancestor assignments” would not satisfy that requirement; the supported action is “An independent ancestor-scope assignment still applies”. Removing a lower-scope assignment cannot revoke a separate role granted higher in the hierarchy.

azure role assignments are additive across scopes and lower-scope grants supplement inherited rights. In this case, a user loses one group membership but keeps inherited subscription Reader access. “The union of applicable inherited and directly assigned RBAC roles” would not satisfy that requirement; the supported action is “An independent ancestor-scope assignment still applies”. Removing a lower-scope assignment cannot revoke a separate role granted higher in the hierarchy.

a higher subscription role would unintentionally affect additional resource groups. In this case, a role assignment was added at a resource group and must affect all its contained VMs. “The exact production resource group” would not satisfy that requirement; the supported action is “RBAC scope inheritance from the resource group”. Child resources inherit permissions granted at parent scopes unless specific authorization mechanisms intervene.

scope inheritance is evaluated against the resource's current hierarchy. In this case, a role assignment was added at a resource group and must affect all its contained VMs. “The resource now inherits access from its new ancestor resource-group scope” would not satisfy that requirement; the supported action is “RBAC scope inheritance from the resource group”. Child resources inherit permissions granted at parent scopes unless specific authorization mechanisms intervene.

azure role assignments are additive across scopes and lower-scope grants supplement inherited rights. In this case, a role assignment was added at a resource group and must affect all its contained VMs. “The union of applicable inherited and directly assigned RBAC roles” would not satisfy that requirement; the supported action is “RBAC scope inheritance from the resource group”. Child resources inherit permissions granted at parent scopes unless specific authorization mechanisms intervene.

removing a lower-scope assignment cannot revoke a separate role granted higher in the hierarchy. In this case, an administrator wants to understand why a user can delete resources despite Reader on the same group. “An independent ancestor-scope assignment still applies” would not satisfy that requirement; the supported action is “All effective roles from user, group and ancestor assignments”. Reader alone cannot delete resources, so a separate additive assignment likely permits the action.

azure role assignments are additive across scopes and lower-scope grants supplement inherited rights. In this case, an administrator wants to understand why a user can delete resources despite Reader on the same group. “The union of applicable inherited and directly assigned RBAC roles” would not satisfy that requirement; the supported action is “All effective roles from user, group and ancestor assignments”. Reader alone cannot delete resources, so a separate additive assignment likely permits the action.

a higher subscription role would unintentionally affect additional resource groups. In this case, an administrator wants to understand why a user can delete resources despite Reader on the same group. “The exact production resource group” would not satisfy that requirement; the supported action is “All effective roles from user, group and ancestor assignments”. Reader alone cannot delete resources, so a separate additive assignment likely permits the action.

removing a lower-scope assignment cannot revoke a separate role granted higher in the hierarchy. In this case, a user is directly assigned Contributor on one VM and inherited Reader on its subscription. “An independent ancestor-scope assignment still applies” would not satisfy that requirement; the supported action is “Contributor rights apply to that VM while Reader applies elsewhere”. A child-scope contributor assignment does not extend full write access to other subscription resources.

azure role assignments are additive across scopes and lower-scope grants supplement inherited rights. In this case, a user is directly assigned Contributor on one VM and inherited Reader on its subscription. “The union of applicable inherited and directly assigned RBAC roles” would not satisfy that requirement; the supported action is “Contributor rights apply to that VM while Reader applies elsewhere”. A child-scope contributor assignment does not extend full write access to other subscription resources.

scope inheritance is evaluated against the resource's current hierarchy. In this case, a user is directly assigned Contributor on one VM and inherited Reader on its subscription. “The resource now inherits access from its new ancestor resource-group scope” would not satisfy that requirement; the supported action is “Contributor rights apply to that VM while Reader applies elsewhere”. A child-scope contributor assignment does not extend full write access to other subscription resources.

child resources inherit permissions granted at parent scopes unless specific authorization mechanisms intervene. In this case, a tenant manages several subscriptions under a shared management group. “RBAC scope inheritance from the resource group” would not satisfy that requirement; the supported action is “Descendant subscriptions and their resources within its scope”. Role inheritance follows the management-group hierarchy and reaches descendant resource scopes.

scope inheritance is evaluated against the resource's current hierarchy. In this case, a tenant manages several subscriptions under a shared management group. “The resource now inherits access from its new ancestor resource-group scope” would not satisfy that requirement; the supported action is “Descendant subscriptions and their resources within its scope”. Role inheritance follows the management-group hierarchy and reaches descendant resource scopes.

removing a lower-scope assignment cannot revoke a separate role granted higher in the hierarchy. In this case, a tenant manages several subscriptions under a shared management group. “An independent ancestor-scope assignment still applies” would not satisfy that requirement; the supported action is “Descendant subscriptions and their resources within its scope”. Role inheritance follows the management-group hierarchy and reaches descendant resource scopes.

child resources inherit permissions granted at parent scopes unless specific authorization mechanisms intervene. In this case, a team should configure only one production resource group, and no others. “RBAC scope inheritance from the resource group” would not satisfy that requirement; the supported action is “The exact production resource group”. A higher subscription role would unintentionally affect additional resource groups.

scope inheritance is evaluated against the resource's current hierarchy. In this case, a team should configure only one production resource group, and no others. “The resource now inherits access from its new ancestor resource-group scope” would not satisfy that requirement; the supported action is “The exact production resource group”. A higher subscription role would unintentionally affect additional resource groups.

reader alone cannot delete resources, so a separate additive assignment likely permits the action. In this case, a team should configure only one production resource group, and no others. “All effective roles from user, group and ancestor assignments” would not satisfy that requirement; the supported action is “The exact production resource group”. A higher subscription role would unintentionally affect additional resource groups.

child resources inherit permissions granted at parent scopes unless specific authorization mechanisms intervene. In this case, after moving a resource between resource groups, an engineer's inherited access changes. “RBAC scope inheritance from the resource group” would not satisfy that requirement; the supported action is “The resource now inherits access from its new ancestor resource-group scope”. Scope inheritance is evaluated against the resource's current hierarchy.

removing a lower-scope assignment cannot revoke a separate role granted higher in the hierarchy. In this case, after moving a resource between resource groups, an engineer's inherited access changes. “An independent ancestor-scope assignment still applies” would not satisfy that requirement; the supported action is “The resource now inherits access from its new ancestor resource-group scope”. Scope inheritance is evaluated against the resource's current hierarchy.

a higher subscription role would unintentionally affect additional resource groups. In this case, after moving a resource between resource groups, an engineer's inherited access changes. “The exact production resource group” would not satisfy that requirement; the supported action is “The resource now inherits access from its new ancestor resource-group scope”. Scope inheritance is evaluated against the resource's current hierarchy.

Contributor grants management operations and is broader than view-only audit requirements. The competing choice “Assign Contributor at the subscription scope because read-only reporting needs write access” does not meet the specific requirement: A security administrator has the built-in Owner role at one resource group but needs to give an auditing colleague read-only access without accidentally inheriting write permissions. Which role should be assigned to the colleague. The supported action is “Assign Reader at the smallest required resource or resource-group scope”.

Owner confers broad administration and the ability to manage role assignments, violating least privilege for an auditor. The competing choice “Copy the Owner assignment so the auditor can modify all production resources” does not meet the specific requirement: A security administrator has the built-in Owner role at one resource group but needs to give an auditing colleague read-only access without accidentally inheriting write permissions. Which role should be assigned to the colleague. The supported action is “Assign Reader at the smallest required resource or resource-group scope”.

Granting role assignment write permissions would allow delegation changes, unrelated to observing resource state. The competing choice “Assign a custom role that grants Microsoft.Authorization/roleAssignments/write to the auditor” does not meet the specific requirement: A security administrator has the built-in Owner role at one resource group but needs to give an auditing colleague read-only access without accidentally inheriting write permissions. Which role should be assigned to the colleague. The supported action is “Assign Reader at the smallest required resource or resource-group scope”.

this role grants targeted access-management abilities without general Owner resource administration. In this case, an application deployer needs to manage resources but policy forbids delegating permissions. “Role Based Access Control Administrator instead of Owner” would not satisfy that requirement; the supported action is “Use Contributor for resource changes and reserve role assignment to access administrators”. Separating deployment operations from access delegation reduces privilege concentration.

effective RBAC depends on the allowed actions at every applicable ancestor and resource scope. In this case, an application deployer needs to manage resources but policy forbids delegating permissions. “Each role's actions and assignment scope against the requested resource” would not satisfy that requirement; the supported action is “Use Contributor for resource changes and reserve role assignment to access administrators”. Separating deployment operations from access delegation reduces privilege concentration.

minimizing allowed actions and scope reduces risk from accidental or compromised access. In this case, an application deployer needs to manage resources but policy forbids delegating permissions. “Use the smallest appropriate built-in or custom role at the smallest scope” would not satisfy that requirement; the supported action is “Use Contributor for resource changes and reserve role assignment to access administrators”. Separating deployment operations from access delegation reduces privilege concentration.

rBAC assignment targets a tenant-resolvable security principal, not an arbitrary external group ID. In this case, an application managed identity needs storage read access without any human sign-in. “The principal exists and is recognized in the target tenant” would not satisfy that requirement; the supported action is “Assign the blob data-reader role to the managed identity principal”. Managed identities are service principals usable in RBAC assignments without embedding user credentials.

minimizing allowed actions and scope reduces risk from accidental or compromised access. In this case, an application managed identity needs storage read access without any human sign-in. “Use the smallest appropriate built-in or custom role at the smallest scope” would not satisfy that requirement; the supported action is “Assign the blob data-reader role to the managed identity principal”. Managed identities are service principals usable in RBAC assignments without embedding user credentials.

separating deployment operations from access delegation reduces privilege concentration. In this case, an application managed identity needs storage read access without any human sign-in. “Use Contributor for resource changes and reserve role assignment to access administrators” would not satisfy that requirement; the supported action is “Assign the blob data-reader role to the managed identity principal”. Managed identities are service principals usable in RBAC assignments without embedding user credentials.

rBAC grants are additive, so a lower-privilege assignment does not restrict a broader Owner grant. In this case, a role assignment failed because the target group is in another unrelated tenant. “The combined permissions, including Owner” would not satisfy that requirement; the supported action is “The principal exists and is recognized in the target tenant”. RBAC assignment targets a tenant-resolvable security principal, not an arbitrary external group ID.

managed identities are service principals usable in RBAC assignments without embedding user credentials. In this case, a role assignment failed because the target group is in another unrelated tenant. “Assign the blob data-reader role to the managed identity principal” would not satisfy that requirement; the supported action is “The principal exists and is recognized in the target tenant”. RBAC assignment targets a tenant-resolvable security principal, not an arbitrary external group ID.

minimizing allowed actions and scope reduces risk from accidental or compromised access. In this case, a role assignment failed because the target group is in another unrelated tenant. “Use the smallest appropriate built-in or custom role at the smallest scope” would not satisfy that requirement; the supported action is “The principal exists and is recognized in the target tenant”. RBAC assignment targets a tenant-resolvable security principal, not an arbitrary external group ID.