AZ-104 Manage Azure Identities and Governance Practice Question
A support engineer needs to restart only one virtual machine named VM-App01. The engineer must not gain access to any other VM, storage account, or network resource in the resource group. At which scope should you assign the required RBAC role?
⚠ Common exam trap
Watch out — candidates often default to assigning roles at the resource group scope for simplicity, overlooking that this grants permissions to all resources in the group, not just the target VM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
At the specific virtual machine resource scope
Assigning the Virtual Machine Contributor role at the specific VM resource scope (VM-App01) grants the engineer permissions to restart only that VM, with no access to other VMs, storage accounts, or network resources in the same resource group. RBAC roles applied at a narrower scope (resource level) override broader scopes and limit permissions to that exact resource.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
At the management group scope that contains the subscription
Why it's wrong here
Management group scope sits at the very top of Azure RBAC hierarchy and cascades down to all subscriptions under that management group. Assigning a role here would grant the engineer the ability to restart virtual machines in every subscription within the entire management group, and potentially across thousands of resources. This is massively overprivileged for a single-VM restart task and also violates the principle of least privilege by introducing an unacceptable blast radius.
When this WOULD be correct
If the question required granting permissions to manage all virtual machines across multiple subscriptions under a management group, then assigning the role at the management group scope would be appropriate.
- ✓
At the specific virtual machine resource scope
Why this is correct
Assigning a role at the specific virtual machine resource scope confines permissions to that single resource by leveraging Azure's hierarchical RBAC model. This is the only option that fulfills the least-privilege requirement, because the support engineer receives only the Microsoft.Compute/virtualMachines/restart/action permission (or a role containing it) and cannot affect other VMs or resource types. It directly targets the resource that the engineer needs to restart.
- ✗
At the resource group scope that contains the virtual machine
Why it's wrong here
A resource group scope extends the role assignment to every resource within that group, meaning the engineer would be able to restart all virtual machines in the resource group, not just VM-App01. Even if you assign the Virtual Machine Contributor role, its permissions cascade to every VM, disk, and network interface in the group, and any future VMs added will inherit the same access. This violates least privilege because the engineer gains control over unrelated resources.
When this WOULD be correct
If the question required the engineer to manage all virtual machines in the resource group (e.g., start/stop any VM) but not storage or network resources, assigning a VM Contributor role at the resource group scope would be appropriate, as it limits permissions to VMs only.
- ✗
At the subscription scope that contains the resource group
Why it's wrong here
Subscription scope applies the role assignment uniformly across all resource groups and all resources in that subscription. The engineer would be able to restart any VM in the subscription, write to any resource type the role permits, and even create or delete resources depending on the role. While narrower than a management group scope, it is still far broader than the single VM requirement and fails least privilege because it exposes the entire subscription to that user's credentials.
When this WOULD be correct
This scope would be correct if the requirement was to grant the support engineer the ability to restart any VM within the entire subscription, without restriction to a specific resource group or VM.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓At the specific virtual machine resource scopeCorrect answer▾
Why this is correct
Assigning a role at the specific virtual machine resource scope confines permissions to that single resource by leveraging Azure's hierarchical RBAC model. This is the only option that fulfills the least-privilege requirement, because the support engineer receives only the Microsoft.Compute/virtualMachines/restart/action permission (or a role containing it) and cannot affect other VMs or resource types. It directly targets the resource that the engineer needs to restart.
✗At the management group scope that contains the subscriptionWrong answer — click to see why▾
Why this is wrong here
Assigning at the management group scope would grant permissions to all subscriptions and resources within that management group, far exceeding the requirement to restrict access to only VM-App01.
★ When this WOULD be the correct answer
If the question required granting permissions to manage all virtual machines across multiple subscriptions under a management group, then assigning the role at the management group scope would be appropriate.
Why candidates choose this
Candidates may think that using a higher scope like management group is more efficient or covers all necessary resources, not realizing it violates the principle of least privilege required in this scenario.
✗At the resource group scope that contains the virtual machineWrong answer — click to see why▾
Why this is wrong here
Assigning the role at the resource group scope would grant the engineer permissions to all resources within that resource group, including other VMs, storage accounts, and network resources, violating the requirement to restrict access only to VM-App01.
★ When this WOULD be the correct answer
If the question required the engineer to manage all virtual machines in the resource group (e.g., start/stop any VM) but not storage or network resources, assigning a VM Contributor role at the resource group scope would be appropriate, as it limits permissions to VMs only.
Why candidates choose this
Candidates often think that assigning a role at the resource group scope is granular enough, not realizing that it applies to all resources in the group, not just the specific VM.
✗At the subscription scope that contains the resource groupWrong answer — click to see why▾
Why this is wrong here
Assigning the role at the subscription scope grants permissions to all resources in the subscription, including other VMs, storage accounts, and network resources, which violates the requirement to restrict access only to VM-App01.
★ When this WOULD be the correct answer
This scope would be correct if the requirement was to grant the support engineer the ability to restart any VM within the entire subscription, without restriction to a specific resource group or VM.
Why candidates choose this
Candidates may think that assigning at the subscription level is simpler or more encompassing, overlooking the principle of least privilege and the specific access restriction required.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.