Assign Contributor Role at Resource Scope for Granular Access Control
A contractor needs Contributor on only VM1 and VM2 in rg-prod. Other resources in rg-prod must remain untouched, and the contractor must not gain access to any other resource groups or subscriptions. Which two role-assignment scopes meet the requirement? Select two.
Quick Answer
The answer is to assign the Contributor role at the VM1 resource scope and at the VM2 resource scope individually. This is correct because Azure role-based access control (RBAC) allows you to assign permissions at a granular resource scope, meaning the contractor receives Contributor rights only on those specific virtual machines, while all other resources within rg-prod—and any other resource groups or subscriptions—remain completely inaccessible. On the AZ-104 exam, this scenario tests your understanding of scope hierarchy and the principle of least privilege, often appearing as a trick where candidates mistakenly assign the role at the resource group scope, which would grant Contributor access to everything inside rg-prod. A common trap is thinking a single assignment can cover multiple resources, but Azure requires separate role assignments for each unique resource scope. Remember the memory tip: “One resource, one assignment—scope it tight, keep access light.”
⚠ Common exam trap
Watch out — candidates often default to assigning roles at the resource group scope for simplicity, forgetting that this grants access to all resources in that group, not just the specified VMs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the role at the VM1 resource scope.
Assigning the Contributor role at the VM1 resource scope grants the contractor permissions exclusively to that virtual machine, leaving all other resources in rg-prod and other scopes untouched. This meets the requirement of limiting access to only VM1 and VM2 within rg-prod.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign the role at the VM1 resource scope.
Why this is correct
A resource-level assignment limits permissions to VM1 and does not extend to unrelated resources.
- ✓
Assign the role at the VM2 resource scope.
Why this is correct
Assigning the Contributor role at the VM2 resource scope precisely limits the contractor's permissions to that specific virtual machine. This granular scope ensures the contractor gains access *only* to VM2, directly satisfying the requirement that other resources within rg-prod remain untouched by this assignment. Furthermore, by restricting the scope to a single resource, it inherently prevents the contractor from gaining any access to other resource groups or subscriptions, upholding the principle of least privilege.
- ✗
Assign the role at the rg-prod resource group scope.
Why it's wrong here
Resource group scope would grant access to every resource inside rg-prod, which is broader than required.
When this WOULD be correct
If the requirement were to grant the contractor Contributor access to all resources within rg-prod (e.g., to manage the entire resource group), then assigning the role at the rg-prod resource group scope would be correct.
- ✗
Assign the role at the subscription scope.
Why it's wrong here
Subscription scope would expose far more resources than the contractor should manage.
When this WOULD be correct
If the requirement were to grant the contractor Contributor access to all resources in the subscription (e.g., for full subscription management), then assigning the role at the subscription scope would be correct.
- ✗
Assign the role at the management group scope.
Why it's wrong here
Management-group scope is the broadest option here and would inherit into many subscriptions.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign the role at the VM1 resource scope.Correct answer▾
Why this is correct
A resource-level assignment limits permissions to VM1 and does not extend to unrelated resources.
✗Assign the role at the rg-prod resource group scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning Contributor at the rg-prod resource group scope would grant the contractor access to all resources in that group, including those that must remain untouched, violating the requirement to limit access to only VM1 and VM2.
★ When this WOULD be the correct answer
If the requirement were to grant the contractor Contributor access to all resources within rg-prod (e.g., to manage the entire resource group), then assigning the role at the rg-prod resource group scope would be correct.
Why candidates choose this
Candidates may mistakenly think that assigning at the resource group scope is more efficient and still allows granular control, overlooking that it grants permissions to all resources in the group, not just the specified VMs.
✗Assign the role at the subscription scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning Contributor at the subscription scope grants the contractor access to all resources in the subscription, including other resource groups and resources in rg-prod beyond VM1 and VM2, violating the requirement to restrict access to only VM1 and VM2.
★ When this WOULD be the correct answer
If the requirement were to grant the contractor Contributor access to all resources in the subscription (e.g., for full subscription management), then assigning the role at the subscription scope would be correct.
Why candidates choose this
Candidates may think subscription scope is necessary to cover multiple VMs, or they may confuse the scope levels and believe subscription is the minimum scope needed for resource access.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Contributor role
The Contributor role is a built-in Azure role that grants full access to manage resources within a scope but does not allow granting access to other users.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to ensure that a contractor can manage virtual machines only in the RG-Test resource group and cannot access any other resource groups in the subscription. What is the best way to achieve this?
medium- A.Assign the Virtual Machine Contributor role at the subscription scope
- ✓ B.Assign the Virtual Machine Contributor role at the RG-Test scope
- C.Assign the Reader role at the RG-Test scope
- D.Assign the Owner role at the RG-Test scope
Why B: Assigning the Virtual Machine Contributor role at the RG-Test scope grants the contractor permissions to manage virtual machines within that specific resource group only, adhering to the principle of least privilege. This role includes actions like creating, starting, stopping, and deleting VMs, but does not allow access to other resource groups in the subscription because the role assignment is scoped to RG-Test.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.