MENU
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a Microsoft Entra tenant named Adatum.com and an Azure Subscription named Subscription1. Adatum.com contains a group named Developers. Subscription1 contains a resource group named Dev.
You need to provide the Developers group with the ability to create Azure Logic Apps in the Dev resource group.
Solution: On Subscription1, you assign the DevTest Labs User role to the Developers group.
Does this meet the goal?
The built-in DevTest Labs User role grants permissions scoped narrowly to working within an existing Azure DevTest Labs lab (creating/managing VMs and environments inside a lab, claiming lab VMs, etc.) - it grants no rights over Microsoft.Logic/workflows (Logic Apps) and does not include general resource-group-level Contributor-style create permissions. Assigning it at the subscription (or even the Dev resource group) scope does not grant the Developers group the Microsoft.Logic/workflows/write action needed to create Logic Apps in the Dev resource group. The correct approach would be assigning a role such as Contributor or Logic App Contributor scoped to the Dev resource group. Because DevTest Labs User does not confer Logic App creation rights, this solution does not meet the goal, so the answer is No.
Official Reference
Azure built-in roles reference --- https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
Currently there are no comments in this discussion, be the first to comment!