A FinOps analyst at Cascade Regional Airlines has been asked to grant other engineers appropriate RBAC roles on the crew-scheduling resource group, but the analyst has no need to create, modify, or delete the resources themselves. Which built-in Azure role best matches this responsibility?
Select an answer to reveal the explanation.
Short Explanation
The analyst's job here is being the gatekeeper who decides who gets which key, not someone who actually opens any of the doors themselves. User Access Administrator is built exactly for that: manage who has access, and stop there.
Full Explanation
User Access Administrator is a built-in role scoped specifically to the access-management portion of Azure RBAC: its actions let a principal view resources and assign or remove role assignments at its scope, without granting any of the underlying resource-provider actions that would let them create, modify, or delete resources. This matches the FinOps analyst's job precisely, managing who has access, without needing hands-on resource permissions. Owner is a superset that includes everything Contributor grants plus the access-management actions User Access Administrator provides, so it satisfies the requirement but massively over-provisions the analyst with full resource control they don't need, violating least privilege. Contributor grants full read/write/delete on resources but deliberately excludes the ability to manage role assignments, so it fails for the opposite reason, it does the wrong half of the job. Reader grants neither resource management nor access management, so an analyst with only Reader couldn't assign roles to anyone. One caveat: User Access Administrator at a broad scope like a subscription is itself highly privileged, since it can be used to grant Owner to anyone, so it should be scoped as narrowly as the task allows. Confirm the assignment by checking Access control (IAM) on the resource group and reviewing the analyst's Role assignments tab.