Describe the capabilities of Microsoft Entra →mediumMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

{
  "roleAssignments": [
    {
      "principalId": "user1@contoso.com",
      "roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
      "scope": "/"
    },
    {
      "principalId": "user1@contoso.com",
      "roleDefinitionId": "194ae4cb-b126-40b2-bd5b-6091b380977d",
      "scope": "/subscriptions/sub1/resourceGroups/rg1"
    }
  ]
}

Refer to the exhibit. You are reviewing Microsoft Entra role assignments for a user. The first assignment has a roleDefinitionId of '62e90394-69f5-4237-9190-012177145e10' at scope '/'. The second assignment has a roleDefinitionId of '194ae4cb-b126-40b2-bd5b-6091b380977d' at a subscription scope. What can you infer?

⚠ Common exam trap

It's easy for candidates to assume the Global Administrator role automatically grants full access to all Azure resources, but in reality, Azure AD roles and Azure RBAC roles are separate authorization systems, and a Global Administrator must be explicitly assigned an Azure RBAC role (like Contributor or Owner) to manage Azure resources.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The user has the Global Administrator role at the tenant level.

The roleDefinitionId '62e90394-69f5-4237-9190-012177145e10' corresponds to the Global Administrator role in Microsoft Entra ID. The scope '/' indicates the tenant root scope, meaning the assignment applies to the entire tenant. Therefore, the user is a Global Administrator at the tenant level, granting broad administrative access to Azure AD (Entra ID) resources. However, Global Administrator does not automatically provide Azure RBAC roles for managing Azure resources; those require separate assignments.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The user has the Global Administrator role at the tenant level.
Why this is correct
Role ID 62e90394... is the Global Administrator role, assigned at tenant scope.
✗
The user can only read Azure AD objects.
Why it's wrong here
Global Administrator can write as well.
✗
The second role is assigned at the subscription scope.
Why it's wrong here
The second role's scope is '/subscriptions/sub1/resourceGroups/rg1', which is resource group scope.
✗
The user is a Global Administrator with full access to all Azure AD and Azure resources.
Why it's wrong here
The root scope gives full access to Azure AD, but not necessarily Azure resources unless the role includes them.

Quick reference

Access Control Model Comparison

Model	Acronym	Who Controls Access?	Best For
Discretionary Access Control	DAC	Resource owner	Small teams, file shares
Mandatory Access Control	MAC	System / security labels	Classified govt / military
Role-Based Access Control	RBAC	Administrator (via roles)	Enterprise environments
Attribute-Based Access Control	ABAC	Policy engine (user + resource attributes)	Fine-grained, dynamic policies
Rule-Based Access Control	RuBAC	System rules / ACLs	Firewall rules, network ACLs

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Access Control Model Comparison

Related to this question