Microsoft Azure Administrator Associate AZ-104 Practice Question

Alex cannot assign roles at the 'Operations' subscription level because his 'User Access Administrator' role assignment is scoped to the 'Networking' resource group. In Azure, permissions are inherited from parent scopes (like subscriptions) to child scopes (like resource groups), but not the other way around. Since Alex's role is assigned at the resource group level, he can only manage user access within that specific resource group and any resources it contains. To assign roles at the subscription level, he would need the 'User Access Administrator' or 'Owner' role assigned at the subscription scope. The 'User Access Administrator' role itself is sufficient for assigning roles, so a more permissive role like 'Owner' is not strictly necessary. The issue is not a deny assignment but the limited scope of the existing role assignment.