AZ-104 Manage Azure Identities and Governance Practice Question
A support engineer must start, stop, and restart only one virtual machine named vm-app01. The engineer should not gain permissions on any other virtual machine in the subscription. What is the best scope for the role assignment?
⚠ Common exam trap
Candidates often default to the resource group scope because it is the most common level for role assignments, but they overlook that the requirement explicitly restricts access to a single VM, which demands the resource-level scope.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The vm-app01 virtual machine resource itself.
Azure RBAC allows role assignments to be scoped to individual resources, such as a specific virtual machine. By assigning a role like 'Virtual Machine Contributor' at the vm-app01 resource scope, the support engineer will have permissions to start, stop, and restart only that VM, and no other resources in the subscription or resource group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The entire subscription that contains vm-app01.
Why it's wrong here
Assigning the role at the entire subscription scope grants the support engineer the ability to manage virtual machines and potentially other resource types across all resource groups in that subscription. This exposes all workloads and infrastructure to the engineer, far exceeding the requirement to manage only one VM. Even within the subscription, there may be critical or unrelated resources that should remain off-limits, so resource-scope assignment is the appropriate choice.
When this WOULD be correct
If the requirement were to manage all virtual machines in the subscription, or if the support engineer needed to start/stop/restart any VM in the subscription, then subscription scope would be appropriate.
- ✗
The resource group that contains vm-app01.
Why it's wrong here
Scoping at the resource group level allows the support engineer to perform start, stop, and restart on every virtual machine in the resource group that contains vm-app01, not just the target machine. If the resource group contains additional VMs or even other compute resources, permissions would unintentionally extend to them, violating least privilege. A role assignment on the VM itself isolates the permission boundary to a single resource.
When this WOULD be correct
If the question required the support engineer to manage all virtual machines within a specific resource group (e.g., start, stop, restart any VM in that group), then assigning the role at the resource group scope would be appropriate.
- ✓
The vm-app01 virtual machine resource itself.
Why this is correct
Assigning a role at the virtual machine resource scope restricts permissions to exactly the vm-app01 resource. The support engineer can only invoke Microsoft.Compute/virtualMachines/start/action, .../deallocate/action, and .../restart/action on that single VM, and cannot affect other VMs or resource group components. This follows the principle of least privilege, granting the minimal access necessary for the specific operational task.
- ✗
The management group that contains the subscription.
Why it's wrong here
A management group is a container for multiple Azure subscriptions, so a role assignment at this scope would inherit permissions to every resource across all subscriptions within that group. This is far broader than required, as the support engineer would gain start, stop, and restart capabilities on every virtual machine in potentially many subscriptions, creating a significant unnecessary security blast radius. The correct scope is the individual VM resource, not a higher-level grouping.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓The vm-app01 virtual machine resource itself.Correct answer▾
Why this is correct
Assigning a role at the virtual machine resource scope restricts permissions to exactly the vm-app01 resource. The support engineer can only invoke Microsoft.Compute/virtualMachines/start/action, .../deallocate/action, and .../restart/action on that single VM, and cannot affect other VMs or resource group components. This follows the principle of least privilege, granting the minimal access necessary for the specific operational task.
✗The entire subscription that contains vm-app01.Wrong answer — click to see why▾
Why this is wrong here
Assigning the role at the subscription scope grants permissions to all virtual machines in the subscription, not just vm-app01, violating the requirement to restrict access to only that VM.
★ When this WOULD be the correct answer
If the requirement were to manage all virtual machines in the subscription, or if the support engineer needed to start/stop/restart any VM in the subscription, then subscription scope would be appropriate.
Why candidates choose this
Candidates may think subscription scope is the simplest way to grant permissions without realizing it grants access to all resources, not just the intended VM.
✗The resource group that contains vm-app01.Wrong answer — click to see why▾
Why this is wrong here
Assigning the role at the resource group scope would grant permissions to all virtual machines within that resource group, not just vm-app01, violating the requirement to limit permissions to a single VM.
★ When this WOULD be the correct answer
If the question required the support engineer to manage all virtual machines within a specific resource group (e.g., start, stop, restart any VM in that group), then assigning the role at the resource group scope would be appropriate.
Why candidates choose this
Candidates may think that since vm-app01 is in a resource group, assigning the role at that level is sufficient, overlooking that it grants permissions to other VMs in the same group.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Role assignment
Role assignment is the process of granting a specific set of permissions to a user, group, or service principal so they can perform certain actions within a system.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.