A subscription Owner enabled PIM for Azure resource roles and wants to grant a senior engineer the ability to manage assignments on those roles for other administrators. The engineer holds no Microsoft Entra ID role. Which assignment satisfies the requirement with least privilege?
- APrivileged Role Administrator in Microsoft Entra ID, because that role manages all PIM assignments globally regardless of scope.
- BSecurity Administrator in Microsoft Entra ID, because Security Administrator manages PIM Azure resource role activations and assignments.
- CUser Access Administrator at the subscription scope, the least-privileged role that can manage PIM Azure resource role assignments. Correct
- DGlobal Reader in Microsoft Entra ID, because Reader cascades to PIM Azure resource role assignment management across the tenant.
Why A is wrong: Privileged Role Administrator governs Microsoft Entra ID roles in PIM; it does not by default have access to manage Azure resource role assignments in PIM.
Why B is wrong: Security Administrator can view but does not by default manage PIM Azure resource role assignments.
Why C is correct: Correct. For Azure resource roles in PIM, only a subscription administrator, resource Owner, or resource User Access Administrator can manage assignments for other administrators.
Why D is wrong: Global Reader is read-only across Microsoft Entra ID and never grants the ability to manage assignments.