AZ-104 Manage Azure Identities and Governance Practice Question
A platform team runs an internal automation tool that must restart VMs and read network interface settings in one resource group. Built-in roles available to the team are broader than the access they want to grant. What should the administrator create?
⚠ Common exam trap
Test-takers frequently choose a built-in role like Contributor or Network Contributor because they see 'restart' or 'network' in the name, without realizing these roles include excessive permissions that violate the principle of least privilege.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A custom role with only the required compute and read permissions, assigned at the resource group scope.
The team needs only specific actions (restart VMs and read network interface settings) within a single resource group. Creating a custom role with only the required compute and read permissions, assigned at the resource group scope, follows the principle of least privilege and avoids granting broader access than necessary. Built-in roles like Contributor or Network Contributor include extra permissions (e.g., write, delete) that are not needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A custom role with only the required compute and read permissions, assigned at the resource group scope.
Why this is correct
A custom role is the preferred approach because it enforces least privilege: the role definition can be scoped to only the specific Microsoft.Compute actions necessary for the automation (for example, Microsoft.Compute/virtualMachines/start/action, restart/action, and read), and assigning it at the resource group scope ensures the tool cannot affect resources outside that boundary. This gives the exact operational permissions needed without granting subscription-wide or unrelated network/admin access.
- ✗
The Contributor role assigned at the subscription scope.
Why it's wrong here
The Contributor role at the subscription scope is wrong because it grants full management access to all resource types across the entire subscription, including create, delete, and modify permissions on compute, storage, network, and other resources. This violates the principle of least privilege and exposes the entire environment to any action the automation tool performs, even if a bug or misconfiguration occurs. The intended solution should be scoped to a single resource group and limited to only the compute and read actions required, not subscription-spanning contributor rights.
When this WOULD be correct
If the question required granting full management access to all resources in a subscription (e.g., for a DevOps team managing all resources), then the Contributor role at subscription scope would be appropriate.
- ✗
The Reader role assigned at the resource group scope.
Why it's wrong here
The Reader role at the resource group scope is wrong because it only permits read operations (for example, Microsoft.Compute/virtualMachines/read) and explicitly does not include any action or write permission. Since the automation tool must restart or start virtual machines, it needs Microsoft.Compute/virtualMachines/restart/action and start/action, which the Reader role denies. Viewer access cannot perform any operational change, so the tool would fail when attempting to manage compute resources.
When this WOULD be correct
A question where the requirement is only to read network interface settings and VM configurations (no restart or write actions) in a resource group. For example: 'A team needs to monitor VM and network interface configurations but must not make changes. What role should be assigned?'
- ✗
The Network Contributor role assigned at the resource group scope.
Why it's wrong here
The Network Contributor role at the resource group scope is wrong because its permissions are limited to Microsoft.Network/* (virtual networks, network interfaces, network security groups, and so on) and it does not include any Microsoft.Compute actions such as virtual machine restart or start. Although the role is scoped to the resource group, the automation tool needs compute operational permissions, not network configuration access, so this role is both insufficient for the required VM operations and overly broad for network changes.
When this WOULD be correct
If the automation tool only needed to read and modify network interface settings (e.g., update IP configurations) and did not require any VM restart or compute permissions, then assigning the Network Contributor role at the resource group scope would be sufficient.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A custom role with only the required compute and read permissions, assigned at the resource group scope.Correct answer▾
Why this is correct
A custom role is the preferred approach because it enforces least privilege: the role definition can be scoped to only the specific Microsoft.Compute actions necessary for the automation (for example, Microsoft.Compute/virtualMachines/start/action, restart/action, and read), and assigning it at the resource group scope ensures the tool cannot affect resources outside that boundary. This gives the exact operational permissions needed without granting subscription-wide or unrelated network/admin access.
✗The Contributor role assigned at the subscription scope.Wrong answer — click to see why▾
Why this is wrong here
The Contributor role at subscription scope grants full management access to all resources in the subscription, which is far broader than the required permissions to restart VMs and read network interface settings in a single resource group.
★ When this WOULD be the correct answer
If the question required granting full management access to all resources in a subscription (e.g., for a DevOps team managing all resources), then the Contributor role at subscription scope would be appropriate.
Why candidates choose this
Candidates may think Contributor is a safe, commonly used role that covers the needed actions, overlooking that it grants excessive permissions beyond the stated requirements.
✗The Reader role assigned at the resource group scope.Wrong answer — click to see why▾
Why this is wrong here
The Reader role grants read-only access, but the automation tool needs to restart VMs, which requires write permissions (e.g., Microsoft.Compute/virtualMachines/restart/action). Reader cannot perform restart operations.
★ When this WOULD be the correct answer
A question where the requirement is only to read network interface settings and VM configurations (no restart or write actions) in a resource group. For example: 'A team needs to monitor VM and network interface configurations but must not make changes. What role should be assigned?'
Why candidates choose this
Candidates may mistakenly think Reader is sufficient because the question mentions 'read network interface settings,' overlooking the restart requirement that demands write permissions.
✗The Network Contributor role assigned at the resource group scope.Wrong answer — click to see why▾
Why this is wrong here
The Network Contributor role only grants permissions for network resources, not for restarting VMs (which requires compute permissions like Microsoft.Compute/virtualMachines/restart/action).
★ When this WOULD be the correct answer
If the automation tool only needed to read and modify network interface settings (e.g., update IP configurations) and did not require any VM restart or compute permissions, then assigning the Network Contributor role at the resource group scope would be sufficient.
Why candidates choose this
Candidates may think Network Contributor covers VM restart because VMs are associated with network interfaces, but it lacks compute-specific actions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure RBAC Role Assignments
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.