Custom role definitions in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the purpose of custom role definitions

What is the main reason to create a custom role definition in Azure?

A To automatically assign roles to all users in a subscription

B To grant permissions that are not available in built-in roles

C To restrict access to Azure portal settings only

D To create a backup of existing built-in roles

💡 Hint

Think about why built-in roles might not always fit every need.

Custom roles allow you to specify permissions that are not covered by built-in roles, enabling precise access control.

❓ Configuration

intermediate

Identifying valid JSON structure for a custom role

Which JSON snippet correctly defines a custom role with permission to read storage accounts?

A { "Name": "Storage Reader", "IsCustom": true, "Permissions": [{ "Actions": ["Microsoft.Storage/storageAccounts/read"] }], "AssignableScopes": ["/subscriptions/12345678-1234-1234-1234-123456789abc"] }

B { "Name": "Storage Reader", "IsCustom": true, "Actions": ["Microsoft.Storage/storageAccounts/read"], "NotActions": [], "AssignableScopes": ["/subscriptions/12345678-1234-1234-1234-123456789abc"] }

C } ]"cba987654321-4321-4321-4321-87654321/snoitpircsbus/"[ :"sepocSelbangissA" ,]} ]"daer/stnuoccAegarots/egarotS.tfosorciM"[ :"snoitcA" {[ :"snoissimreP" ,eurt :"motsuCsI" ,"redaeR egarotS" :"emaN" {

D { "Name": "Storage Reader", "IsCustom": true, "Actions": ["Microsoft.Storage/storageAccounts/read"], "AssignableScopes": ["/subscriptions/12345678-1234-1234-1234-123456789abc"] }

💡 Hint

Check the exact property names and structure required by Azure for custom roles.

Azure custom role definitions use PascalCase property names like 'Name', 'IsCustom', 'Permissions', and 'AssignableScopes'. The 'Permissions' property is an array of objects containing 'Actions' and 'NotActions'. Option A matches the standard structure used in Azure documentation.

❓ Architecture

advanced

Scope assignment impact on custom roles

You assign a custom role at the resource group level. What is the effect on access permissions?

A The role permissions apply only to the resource group and its parent subscription

B The role permissions apply to all subscriptions under the tenant

C The role permissions apply to all resource groups in the subscription

D The role permissions apply only to resources within that resource group

💡 Hint

Consider how Azure RBAC scopes permissions hierarchically.

Assigning a role at the resource group level limits permissions to that group and its resources only.

❓ security

advanced

Least privilege principle with custom roles

Which practice best follows the least privilege principle when creating custom roles?

A Grant all read permissions to simplify access

B Grant contributor role permissions to avoid missing access

C Grant only the specific actions needed for the user's tasks

D Grant permissions at the subscription level by default

💡 Hint

Least privilege means giving only what is necessary, nothing more.

Limiting permissions to only what is needed reduces security risks and follows best practices.

❓ service_behavior

expert

Effect of missing 'AssignableScopes' in custom role definition

What happens if you create a custom role definition in Azure without specifying the 'AssignableScopes' property?

A The role cannot be assigned to any scope and will cause an error

B The role is automatically assignable to all subscriptions in the tenant

C The role is assignable only to the subscription where it was created

D The role is assignable only to resource groups within the subscription

💡 Hint

Think about the role assignment process and required properties.

'AssignableScopes' is mandatory; without it, Azure rejects the role definition as it cannot be assigned anywhere.