Microsoft Certified: Azure Administrator AssociateManage Azure identities and governanceEasy
A company is implementing a new Azure subscription for a development team. The team lead needs to be able to create, modify, and delete all resources within the subscription, including virtual machines, storage accounts, and networking components. However, the team lead should NOT be able to manage access to resources (i.e., assign or remove roles) or manage billing. Which built-in Azure role should be assigned to the team lead?
- AOwner
- BDevTest Labs User
- CContributor
- DUser Access Administrator
Show answer & explanationAnswer & explanation
Correct answer: C. Contributor
The 'Contributor' role grants full access to manage all resources, but it does not allow you to assign roles in Azure RBAC or manage access to resources. This perfectly matches the requirement for the team lead to manage all resources without managing access or billing.
Why the other options are wrong
- A. Owner has full access to manage all resources, including the ability to manage access to resources, which is explicitly excluded in the requirement.
- B. DevTest Labs User is specific to Azure DevTest Labs and has limited permissions, not full resource management across a subscription.
- D. User Access Administrator only manages user access to Azure resources (RBAC) and does not have permissions to create or manage other resources.
Azure Contributor Role
A built-in Azure RBAC role that grants full access to manage all resources, but does not allow managing access to resources (RBAC) or managing billing.
- Can create, modify, delete any resource.
- Cannot assign roles to others.
- Cannot manage billing.
Memory trick: Contributor: Can build anything, but not the boss of people or money.