Home › Azure AZ-900 › cloudcomputing › identitysecurity › An administrator wants to grant a contractor rea…
An administrator wants to grant a contractor read-only access to ONE specific resource group for the duration of their engagement, and no broader access. Which Azure construct best achieves this with the least privilege?
AGive the contractor the 'Owner' role on the entire subscription
BEmail the contractor the subscription's billing API key
CAssign the contractor the built-in 'Reader' RBAC role scoped to that single resource group
DMake the contractor a global administrator of the Entra tenant
Answer & Solution
Correct answer: C. Assign the contractor the built-in 'Reader' RBAC role scoped to that single resource group
Reader scoped to a specific resource group is the minimal grant that satisfies the requirement — RBAC at the right scope and role. Owner on subscription / global admin / shared API key all wildly over-grant access and violate least privilege.
Related questions
Which Microsoft Entra capability adds a second authentication factor like an AuthenticatorMicrosoft Defender for Cloud is best described as:The defense-in-depth model recommends:The Zero Trust security model is based on which guiding principle?Microsoft Entra Domain Services differs from Microsoft Entra ID in that Domain Services:Microsoft Entra B2B (external identities) is designed to let an organisation:Azure role-based access control (RBAC) grants permissions by combining three things. WhichPasswordless authentication on Microsoft Entra typically replaces the password with which