Microsoft Azure Security Technologies (AZ-500)

What should you use to configure role assignments for separate subscriptions linked to the same Azure AD tenant?

1. Azure Security Center

2. Azure Policy

3. Azure AD Privileged Identity Management (PIM)

4. Azure Blueprints

The correct answer is: Azure Blueprints

The most appropriate choice for configuring role assignments across separate subscriptions linked to the same Azure Active Directory (AD) tenant is Azure Blueprints. Azure Blueprints provide a way to define and manage the policies, role assignments, and resource templates required to set up and manage Azure environments consistently. By using Blueprints, you can package multiple resources, including role assignments, into a single deployable entity that can be assigned across multiple subscriptions. This capability is essential for organizations that want to ensure compliance, governance, and consistent configurations across different departments or business units that operate within separate subscriptions but share the same Azure AD tenant. In contrast, Azure Security Center focuses more on security management and threat protection, Azure Policy is used for enforcing specific rules and effects over your resources, and Azure AD Privileged Identity Management (PIM) is designed for managing and controlling access to Azure resources by enabling just-in-time access and requiring approval for assignment. While each of these tools has its own strengths, none are specifically tailored for the broad configuration and management of role assignments across multiple subscriptions like Azure Blueprints is.