A custom role definition must grant read access to every resource type from every resource provider, and nothing else. Which actions entry accomplishes this?
Show answer and explanation
Answer: B
An action string has the form provider/resourceType/operation, and wildcards are allowed in each segment. The wildcard pattern that ends in /read matches the read operation on any resource type from any provider, which is exactly the permission Reader uses. It does not match write, delete or action operations because their final segment is not read. Using this single entry is more maintainable than enumerating providers, and it keeps the role from accidentally allowing changes.
Why the other options are wrong
- A. Microsoft.*/* matches every operation on providers whose name begins with Microsoft, so it would grant write and delete as well as read. It is not limited to reads.
- C. Microsoft.Resources/*/read is restricted to the Microsoft.Resources provider. Resources from providers such as Microsoft.Compute or Microsoft.Storage would not be covered.
- D. A bare asterisk matches every operation, including create, delete and action operations. It is effectively full control, not read-only.
Exam tip. */read is the canonical read-everything pattern and mirrors the Reader role.