Exam AZ-305 topic 4 question 75 discussion

1. Owner 2. Owner https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-how-subscriptions-associated-directory#before-you-begin Before you can associate or add your subscription, do the following steps: - Sign in using an account that: Has an Owner role assignment for the subscription.

User1: b. Owner User2: b. Owner For User1 who needs to change the Azure AD tenant linked to specific Azure subscriptions, they need to be assigned the role of "Owner". This is because to change the Azure AD tenant linked to a subscription, the user must have enough permissions, which are available at the Owner level. For User2 who needs to have the access elevated to the subscription if no available Azure AD accounts have full subscription-level permissions to the subscription, they need to be assigned the "Owner" role as well. This role provides full access to all resources, including the right to delegate access to others. In this scenario, the "Owner" role would allow User2 to gain access to the subscription in the absence of any other account with full permissions.

CORRECT

User1: Owner User2: Co-administrator Reason why it is co-admin is because it states that the user should be able to elevate access, which can be done with admin role. https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal

Given answer is correct, Owner-Owner or Global admin but GA is not part of the solution

owner owner is correct answer.

User1: Service Admin Service Admin fits to all the requirements whereas Owner has more than required permissions "By default, for a new subscription, the Account Administrator is also the Service Administrator. The Service Administrator has the equivalent access of a user who is assigned the Owner role at the subscription scope. The Service Administrator has full access to the Azure portal." https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles User2: Owner

1.Service administrator 2.Co-administrator reference : https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles#classic-subscription-administrator-roles

- Co-Administrator "can't change the association of subs to Azure AD directories so it's out. - Given that the tenants & some subs exist then, & since we live in the real world (as strange as it's become) & there's no mention otherwise, & given the options we can presume User 1 to have the Service Administrator role, which provides full access to the Azure portal. - Given "elevate the access" is a requirement for User, the only deduction in this whole madness of stupidity mess possible is Owner. https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles

Service Administrator and Co-Administrator are classic subscription roles that have the equivalent access of a user who is assigned the Owner role at the subscription scope. The answer for both is Owner. https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles

Owner Owner

Based on the requirements in the question given answer looks correct to me.

Owner Owner

From ChatGPT: An Azure AD Service Administrator role is designed to manage user, groups and other resources within an Azure AD tenant. While they can manage the users and groups, they don't have the permission to move a subscription from one tenant to another. To move a subscription from one tenant to another, you need to have the "Subscription Owner" or "Global Administrator" role within the Azure AD tenant to which you want to move the subscription. So I think the answer should be "Owner" x 2

There are only four "Azure roles", and "Owner" is the only "role" in the answers, the other two are "Classic subscription administrator". The Service Administrator and Co-Administrators are assigned the Owner role at the subscription scope. https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles#azure-roles

Service Administrator and Co-Administrator were a classic subscription role. These to Roles equivalent is current role assignment is Owner. So I think answer is correct. you don't want to use classic RBAC as Microsoft will move away on this classic roles in the future. do future proofing a bit on this.

The answer is correct to me: https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-how-subscriptions-associated-directory