A platform team writes Azure Policy definitions and needs the narrowest built-in role that lets a designated identity assign those policies at a management group scope. The role must NOT grant the ability to create, rename, move, or delete management groups, and must NOT grant the ability to assign access (other RBAC roles). Which built-in role is the documented best fit?
- AOwner role on the parent management group
- BManagement Group Contributor
- CUser Access Administrator
- DResource Policy Contributor Correct
Why A is wrong: Owner is the broadest role - it grants Create, Rename, Move, Delete, Assign Access, Assign Policy, and Read - which violates the requirement to NOT grant access assignment or hierarchy management.
Why B is wrong: Management Group Contributor grants Create, Rename, Move, and Delete on management groups, which the scenario explicitly forbids; it also does not include Assign Policy.
Why C is wrong: User Access Administrator grants Assign Access plus Assign Policy, which over-grants access management beyond what the scenario allows.
Why D is correct: Correct. The management groups documented roles table grants Resource Policy Contributor the Assign Policy action and nothing else: no Create, Rename, Move, Delete, Assign Access, or Read of the management group itself.