Ashgrove Financial has 14 subscriptions organized under a management group named MG-Corp, with two child management groups MG-Prod and MG-NonProd. The central security team, represented by the group GRP-SecOps, must have read access to every resource in every current and future subscription under MG-Corp. The company wants to minimize administrative effort.
What should you do?
- AAssign the Reader role to GRP-SecOps on each of the 14 subscriptions.Fourteen assignments work today but every new subscription would need another manual assignment, which does not minimize administrative effort.
- BAssign the Reader role to GRP-SecOps at the MG-Corp management group scope.A single assignment at the top management group is inherited by MG-Prod, MG-NonProd, all 14 subscriptions, and any subscription moved under MG-Corp in the future.
- CAssign the Reader role to GRP-SecOps at the MG-Prod and MG-NonProd management group scopes.Two assignments cover the current children, but a subscription placed directly under MG-Corp or a new child management group would be missed.
- DAssign the Security Reader role to GRP-SecOps at the Tenant Root Group scope.Security Reader is a Microsoft Defender for Cloud role, not general resource read, and assigning at the Tenant Root Group goes beyond MG-Corp to subscriptions the security team was not scoped to.
Why: Management groups exist precisely so that role assignments and policies can be applied once and inherited across many subscriptions. The deciding constraints are future subscriptions must be covered automatically and minimal effort, which points to a single assignment at the highest management group that bounds the requirement, MG-Corp. Assigning any higher (Tenant Root Group) exceeds the intended scope, and assigning any lower leaves gaps. Reader is the correct general-purpose role; Security Reader is a Defender-specific role that sounds similar.