Microsoft Certified: Azure Administrator AssociateManage Azure identities and governanceMedium
A company is restructuring its Azure environment. They have a single Azure subscription, 'DevSubscription', which is currently under a management group named 'Development'. They need to move 'DevSubscription' to a new management group named 'Production' to align with new organizational policies. Which role at the root scope (/) is required for a user to perform this subscription move?
- AUser Access Administrator
- BContributor
- CSubscription Administrator
- DOwner
Show answer & explanationAnswer & explanation
Correct answer: D. Owner
To move a subscription between management groups, the user must have the Owner role at the root scope (/) of the Azure hierarchy. This ensures they have the highest level of permissions to manage subscriptions and management groups.
Why the other options are wrong
- A. User Access Administrator manages user access to resources, but not the ability to move subscriptions.
- B. Contributor role is insufficient as it does not include permissions to move subscriptions.
- C. Subscription Administrator is a classic role and does not grant the necessary permissions at the root scope for management group operations.
Subscription Move Permissions
Moving an Azure subscription between management groups requires specific permissions, typically the Owner role at the root scope (/) or on both the source and target management groups.
- Owner role at root scope (/) is the most common requirement.
- Alternatively, Owner on both source and target management groups.
- Subscription must be in a non-default management group after move.
Memory trick: To move the whole box, you need to be the Owner of all locks.