Exam AZ-500 topic 2 question 87 discussion

A - Wrong - Hybrid Identity Admin cannot create managed identities. Permissions are: Can manage AD to Azure AD cloud provisioning, Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single sign-on (Seamless SSO), and federation settings. B - wrong - Managed Identity Operator cannot create managed identities. Permissions are: Read and Assign User Assigned Identity C - correct: Managed Identity Contributor can Create, Read, Update, and Delete User Assigned Identity. D - incorrect - can create users, but does not follow the principal of least privilege, as the permission set is comprehensive. User administrator can manage all aspects of users and groups. https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

C. Create a resource group and assign User1 to the Managed Identity Contributor role. Explanation: Managed Identity Contributor Role: This role allows the user to manage managed identities, including creating and deleting them, within the scope of the assigned resource group. It provides the necessary permissions without granting excessive access1. Principle of Least Privilege: By assigning the Managed Identity Contributor role at the resource group level, you ensure that User1 has the minimum permissions required to perform the task, reducing the risk of unnecessary access to other resources.

B. Create a management group and assign User1 the Managed Identity Operator role. The Managed Identity Operator role provides the necessary permissions for managing managed identities within Azure, while following the principle of least privilege. This role allows the user to create, update, and delete managed identities without granting broader permissions than necessary.

What's the resource group for ?

C is the answer. https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities?pivots=identity-mi-methods-azp#create-a-user-assigned-managed-identity To create a user-assigned managed identity, your account needs the Managed Identity Contributor role assignment.

C. Create a resource group and assign User1 to the Managed Identity Contributor role.