Question

You manage an Azure environment for Contoso. A new colleague, Amit, needs to view all resources across every resource group in the Production subscription, but he must not be able to make any changes. You want to grant this access with the fewest role assignments possible while following least-privilege principles. What should you do?

Accepted Answer

Assign Amit the Reader role at the Production subscription scope.

Answer

Assign Amit the Contributor role at the Production subscription scope.

Answer

Assign Amit the Reader role individually on each resource group in the subscription.

Answer

Assign Amit the Owner role at the management group that contains the Production subscription.