Cloud · Microsoft Azure · Certifications
AZ-500: RBAC provider for tag management
Select one answer. Your result and the explanation will appear immediately.
Question 6
You are tasked with creating a custom Azure role-based access control (RBAC) role to allow management of tags for all resources within a management group named Group1. The management group contains an Azure subscription with the ID 11111111-1234-1234-1234-111111111111. Which resource provider should be included in the role definition to enable tag management for all objects in Group1?
Correct answer: Microsoft.Resources
Tag operations are exposed through the Microsoft.Resources resource provider, for example Microsoft.Resources/tags/read and Microsoft.Resources/tags/write. Adding the required Microsoft.Resources tag actions to a custom role allows tag management across resource types at the assigned scope.
Exam clue: Tags are Azure Resource Manager metadata that apply broadly across resource types, so they belong to Microsoft.Resources rather than a service-specific provider.
Remember: Use Microsoft.Resources/tags/* for tag permissions in custom RBAC roles. Microsoft.Authorization manages role assignments and definitions, not resource tags.