Microsoft Certified: Azure Fundamentals (AZ-900) Practice Exam

If you want to provide a group with the ability to create and manage all Azure resources while minimizing rights, which RBAC role should be assigned?

1. Contributor

2. User Access Administrator

3. Reader

4. Owner

The correct answer is: Contributor

Assigning the Contributor role is appropriate for giving a group the ability to create and manage all Azure resources while minimizing rights. The Contributor role allows users to perform any action on resources, except for granting access to others, making it ideal for scenarios where management capabilities are needed without the overhead of permission management that comes with higher roles. This ensures that the group can operate effectively within Azure but does not have the authority to alter access permissions for other users, thereby limiting their administrative responsibilities. The other roles have different scopes and permissions. The User Access Administrator role focuses specifically on managing user access, which is not necessary here since the goal is to manage resources. The Reader role allows only viewing of resources, which does not meet the requirement for creating and managing them. The Owner role grants full permissions, including the ability to manage access, which exceeds the intended limitation of rights in this scenario.