Describe access management capabilities of Microsoft Entra ID
Objective entra.access-management sits in Describe capabilities of Microsoft Entra, which carries 28% of the SCI Fundamentals exam. The questions below are original, written from the official objective title above, and each explanation cites the Microsoft Azure page it rests on.
Objective title verbatim from the official objectives. Microsoft Azure exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An administrator assigns the Contributor role to the Marketing group so its members can manage resources, but only inside the pharma-sales resource group and nowhere else in the subscription. Which element of the role assignment enforces this restriction?
The concept
Every Azure role assignment answers three separate questions: who is asking, what actions are permitted, and over which slice of the resource hierarchy those actions run. Confusing the three is the usual error, because widening or narrowing the reach of an assignment is a different operation from changing the list of permitted actions.
Why this answer
Scope can be set at management group, subscription, resource group, or resource level, so setting it to the pharma-sales resource group confines the Contributor permissions to that resource group only.
- Correct: scope is the element that limits which resources an assignment applies to.
- BThe role definition lists the actions allowed (like Contributor's permissions) but does not itself restrict which resource group those actions apply to.
- CThe security principal identifies who is receiving access (the Marketing group here) but does not limit where the access applies.
- DA deny assignment blocks access outright and is not the mechanism used to limit Contributor access to a single resource group.
Now you: objective entra.access-management questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
An administrator wants the Marketing group to manage resources only inside the pharma-sales resource group, not across the entire subscription. Which Azure RBAC element enforces that restriction?
Sample question 2 of 3
A user is assigned the Contributor role at the subscription level and the Reader role at a resource group within that subscription. Given how Azure RBAC combines overlapping role assignments, what is the user's effective access on that resource group?
Sample question 3 of 3
A policy states that accessing a finance app requires multifactor authentication. At what point in the sign-in is that policy applied?
Full SCI Fundamentals question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.