You have an Azure subscription that contains a user named Admin1 and a resource group named RG1. RG1 contains an Azure Network Watcher instance named NW1. You need to ensure that Admin1 can place a lock on NW1. The solution must use the principle of least privilege. Which role should you assign to Admin1?

Creating or deleting a resource lock requires the permission Microsoft.Authorization/locks/, which is included in the Microsoft.Authorization//write action.

Among the built-in roles, Owner and User Access Administrator both contain Microsoft.Authorization//write, but Owner can modify or delete every resource in the scope, exceeding the required privileges.

User Access Administrator does not allow management of the resources themselves; it only lets the principal manage access control (RBAC) and locks. Therefore, assigning User Access Administrator on NW1 (or RG1) lets Admin1 place a lock while adhering to the principle of least privilege.

B. Network Contributor lacks Microsoft.Authorization/ permissions; it cannot create or delete locks.

C. Resource Policy Contributor is limited to policy resources (Microsoft.Authorization/policy); it has no lock permissions.

D. Monitoring Contributor grants rights to monitoring resources (metrics, alerts) only; it has no authorization or lock permissions.

1. Microsoft

“Azure built-in roles – User Access Administrator

” Microsoft Entra and RBAC documentation

section “Actions

” shows Microsoft.Authorization//write (including locks). https://learn.microsoft.com/azure/role-based-access-control/built-in-roles#user-access-administrator

2. Microsoft

“Lock resources to prevent unexpected changes

” Azure Resource Manager docs

section “Required permissions

” para. 2: “You must have Microsoft.Authorization/locks/ permission

such as Owner or User Access Administrator.” https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources

3. Microsoft

“Azure built-in roles – Network Contributor

” same page

lists NotActions Microsoft.Authorization/

confirming no lock rights.

4. Microsoft

“Azure built-in roles – Resource Policy Contributor” and “Monitoring Contributor

” same page

list only policy- or monitor-related actions

not Microsoft.Authorization/locks/.