Unit 1 capstone — Onboarding an acquired subsidiary
AZ-104 › Unit 1 › Capstone
Unit 1 capstone — Onboarding an acquired subsidiary
Contoso acquires Northwind
- AZ104-U1
- 3
- 15
- 6
- 25 minutes
The brief
Contoso has acquired Northwind, a 400-person business with its own Microsoft Entra tenant. Northwind's staff keep their existing sign-ins for at least a year. Their engineering contractors need to look at one Contoso resource group and nothing else. Contoso's own service desk must be able to grant access to Northwind staff — but only inside the subscription set aside for the integration, and without becoming able to change resources. Finance has been surprised by cloud spend twice this year and wants it not to happen again. Nothing in the production resource group may be deleted while the migration runs, and every resource created during it must be attributable to a cost centre.
What they need
- Northwind's 400 staff sign in with their existing credentials, without Contoso creating and managing 400 new accounts.
- Northwind's contractors can read one Contoso resource group and nothing else.
- The service desk can grant others access inside the integration subscription, but cannot change the resources in it.
- Every resource created in the integration subscription carries a cost-centre tag, whether or not the person creating it remembers.
- Nothing in the production resource group can be deleted during the migration.
- Finance is told when the integration subscription passes 80% of its monthly budget.
Commit before you read on
Write down your answer to each of the 6 numbered requirements above — the mechanism, and the scope you would apply it at. Then open the working below and compare. Reading the reasoning beside the question is the one way to feel like you knew it without having known it.
▶Show the working
1. 400 staff, their own credentials
B2B collaboration guests.
The partner uses their own identity management, so there is no account lifecycle for Contoso to run. Guests appear in the directory as user objects whose user principal name contains the #EXT# identifier. Note the side effect to control deliberately: by default every user in the organization, including existing guests, can invite more guests. If that is not wanted, external collaboration settings are the place to restrict it — not a role assignment.
2. Contractors read one resource group
Reader, assigned at the resource group scope.
Reader grants viewing and no changes. The examinable half is the scope: assign it at the resource group, not the subscription, because lower levels inherit from higher levels and there is no way to subtract an inherited assignment lower down. Assign to a group rather than to each contractor — a group is a security principal, so one assignment does the work of many.
3. Service desk grants access but cannot change resources
User Access Administrator at the subscription scope.
This is the requirement that eliminates the two obvious answers. Contributor grants full access to manage all resources but explicitly not the ability to assign roles — so it fails the first half. Owner grants full access including role assignment — so it fails the second. Only the role that separates access management from resource management satisfies both.
4. Every resource carries a cost-centre tag
An Azure Policy assignment that requires — or appends — the tag.
Tagging the resource group does nothing for its contents: resources don't inherit the tags you apply to a resource group or a subscription. Policy is the mechanism that makes a tag arrive on the resource. And note what policy is doing here — governing the state a resource may be in, not anybody's access.
5. Nothing deletable in production
A CanNotDelete lock at the resource group scope.
The portal calls it Delete; the command line calls it CanNotDelete. It lets authorized users read and modify but not delete, it is inherited by everything in the scope including resources added later, and the most restrictive lock in the chain wins. It is a control-plane guard, so it does not protect data inside a resource — which is not what was asked for here.
6. Finance told at 80% of budget
A budget with an alert at the 80% threshold.
And the sentence that decides the wrong answers: notifications are triggered when thresholds are exceeded, resources aren't affected, and consumption isn't stopped. A budget notifies. If the stem had said "prevent overspend", no budget would answer it. Budgets are evaluated every 24 hours, so this is not a real-time control either.
The reasoning this unit rewards
Check yourself
Where these figures come from
Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.
| Document | sha1 |
|---|---|
| B2B collaboration overview | b0768f637b07 |
| Understand scope for Azure RBAC | 87e7f6fe1b69 |
| Azure built-in roles | 068bc2c7255f |
| Use tags to organize your Azure resources | b1d92e330865 |
| Lock your Azure resources | 0a4f4f548288 |
| Tutorial: Create and manage Azure budgets | 051db0341cf9 |