Microsoft Certified: Azure Administrator AssociateManage Azure identities and governanceHard
A company is restructuring its Azure environment. They have an existing Azure subscription named 'DevTest' that currently resides under a management group named 'Development'. They need to move the 'DevTest' subscription to another management group named 'Production' to align with new organizational guidelines. What is the minimum Azure RBAC role required on the *destination* management group ('Production') for an administrator to successfully perform this move?
- AManagement Group Contributor
- BOwner
- CContributor
- DSubscription Contributor
Show answer & explanationAnswer & explanation
Correct answer: B. Owner
To move a subscription between management groups, the administrator needs the 'Owner' role on the *destination* management group and the 'Owner' or 'Contributor' role on the *subscription itself*. The question specifically asks for the minimum role on the *destination management group*.
Why the other options are wrong
- A. There is no built-in 'Management Group Contributor' role. The closest would be Contributor, which is insufficient for this action.
- C. The 'Contributor' role on a management group does not provide sufficient permissions to move a subscription into it.
- D. This role exists at the subscription scope; it's not a management group role and is insufficient for moving subscriptions between management groups.
Move Azure Subscription between Management Groups Permissions
Moving an Azure subscription requires specific RBAC permissions on both the subscription being moved and the target (destination) management group.
- Owner role is required on the *destination* management group.
- Owner or Contributor role is required on the *subscription* being moved.
- Moving subscriptions affects policy and RBAC inheritance.
Memory trick: To put a subscription into a new house (MG), you need to be the Owner of that new house.