A finance operations team manages virtual machines in RG-App. They must start, stop, deallocate, and view VM properties for any VM in that resource group. They must not be able to delete VMs, read NIC settings, or manage disks. What should the administrator do?

Assign the built-in Virtual Machine Contributor role at the subscription scope.

This would allow VM management, but the scope is too broad and includes every resource group in the subscription.

Assign the built-in Reader role at the RG-App scope and let the team use portal buttons.

Reader allows viewing resources, but it cannot start, stop, or deallocate virtual machines.

Assign the built-in Contributor role at the resource group scope.

Contributor is far broader than required and would permit changes to NICs, disks, and many unrelated resources.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create a custom role with only the required VM actions and assign it at the RG-App scope. — A custom role is the best fit when built-in roles are broader than the business requirement. By placing the assignment at RG-App scope, the team can manage only the virtual machines in that resource group and cannot act on resources elsewhere in the subscription. The custom role can include only the specific compute actions required for power operations and read access to VM properties, which supports least privilege and avoids accidental access to disks, NICs, or other resource types. Why others are wrong: Virtual Machine Contributor and Contributor both grant more permissions than required, so they violate least-privilege design. Reader is too restrictive because it cannot perform power operations. The key design decision is not just the role name, but also the assignment scope: using a custom role at the resource group scope provides the narrowest practical access boundary for this request.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.