Topic 1 · Question 8

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.
You are planning to migrate a company to Azure. Each of the company's numerous divisions will have an administrator in place to manage the Azure resources used by their respective division.
You want to make sure that the Azure deployment you employ allows for Azure to be segmented for the divisions, while keeping administrative effort to a minimum.
Solution: You plan to make use of several Azure Active Directory (Azure AD) directories.
Does the solution meet the goal?

A. Yes

B. No

Top comment

Community votes:B · 22 (96%)A · 1 (4%)

Georgess▲ 171Highly votedOctober 23, 2021 08:40 pm

The proposed solution is: You plan to make use of several Azure Active Directory (Azure AD) directories.
I think the key word is SEVERAL. Why in the world a company will create SEVERAL AADs when it can create a single AAD and organize its divisions right there?
This is why I consider the correct answer B (No).

3 more highly voted comments

BeauChateau▲ 45Highly votedSelected: BSeptember 21, 2024 08:55 am

No, the solution does not meet the goal.

Using multiple Azure Active Directory (Azure AD) directories to segment Azure resources for each division may not be the most efficient way to manage the resources. While it does provide segregation of resources and administrative control, it can result in additional administrative effort for managing multiple directories.

A better solution would be to use Azure Resource Manager (ARM) to create separate resource groups for each division. Resource groups allow for segregation of resources, while still providing a single management interface. Each division can have an administrator assigned to their respective resource group, allowing them to manage the resources for their division.

Using Azure Resource Manager (ARM) to create separate resource groups for each division provides an efficient way to segment Azure resources while keeping administrative effort to a minimum. Therefore, the proposed solution of using multiple Azure AD directories does not meet the goal, and using Azure Resource Manager (ARM) to create separate resource groups should be used instead.

Soumyat85▲ 10Highly votedSeptember 21, 2024 08:55 am

B. No
The solution does not meet the goal. Creating several Azure Active Directory (Azure AD) directories would separate the Azure resources into different environments, but it would also increase administrative effort and complexity. Each Azure AD directory would require separate management and administration, leading to duplication of efforts and potential challenges in maintaining consistency across divisions.
A more appropriate solution to meet the goal of segmenting Azure for divisions while minimizing administrative effort would be to use Azure RBAC (Role-Based Access Control) and resource groups. By leveraging Azure RBAC, you can assign division-specific administrators with appropriate access permissions to manage the Azure resources within their respective resource groups. This approach allows for segregation of resources based on divisions while maintaining centralized management and reducing administrative overhead.

mmmmmnm▲ 8Highly votedSelected: BDecember 22, 2021 02:47 am

The answer is B.
They should utilize different subscriptions.

Open discussion on ExamTopics ↗