AZ-104 Manage Azure Identities and Governance Practice Question
A support team must be able to start, stop, and restart virtual machines in one application resource group, but they must not create or delete VMs, modify disks, or manage networking. What is the best access approach?
⚠ Common exam trap
Watch out — candidates often confuse Azure Policy or resource locks with RBAC, thinking they can grant or restrict permissions, when in fact they are separate governance tools—Policy enforces rules, locks prevent changes, and only RBAC roles control who can perform actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom RBAC role with only the required VM power actions and assign it at the resource group scope.
Azure RBAC allows you to create a custom role with specific actions like Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/restart/action, and Microsoft.Compute/virtualMachines/deallocate/action, and assign it at the resource group scope. This grants the support team exactly the permissions needed to start, stop, and restart VMs without allowing VM creation, deletion, disk modification, or networking changes, adhering to the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign Contributor at the subscription scope so the team can manage all resources.
Why it's wrong here
Contributor grants broad management rights across the scope, which is more access than the requirement allows. It would let the team modify many resource types beyond virtual machines. This violates least privilege and increases the chance of unintended changes.
When this WOULD be correct
This option would be correct if the question required the team to have full management capabilities over all resources in the subscription, including creating and deleting VMs, modifying disks, and managing networking, without any restrictions.
- ✓
Create a custom RBAC role with only the required VM power actions and assign it at the resource group scope.
Why this is correct
A custom role is appropriate when the built-in roles are broader than the actual task. By granting only the VM start, stop, and restart actions needed for that resource group, the administrator keeps permissions tightly limited. Assigning the role at the resource group scope also ensures the team cannot affect resources outside that application boundary.
- ✗
Assign Reader at the resource group scope and use Azure Policy to permit VM restarts.
Why it's wrong here
Reader provides view-only access and cannot perform operational actions on VMs. Azure Policy does not grant permissions to users; it enforces compliance for resources. This combination cannot satisfy the requirement to restart or stop virtual machines.
When this WOULD be correct
If the question required preventing unauthorized modifications while allowing read access, and the team needed to view VM status but not perform any actions, then assigning Reader at the resource group scope would be correct. Azure Policy could be used to audit or enforce settings, not to grant permissions.
- ✗
Apply a resource lock to the resource group so the team can only make approved changes.
Why it's wrong here
Locks are a change-prevention control, not a permission model for selective operational access. A lock would block some operations, but it would not selectively grant start, stop, or restart permissions. It also would not replace RBAC for least-privilege access.
When this WOULD be correct
In a scenario where the goal is to prevent accidental deletion or modification of critical resources while still allowing authorized users to manage them via RBAC, a resource lock would be correct. For example, a question asking 'How to protect a resource group from accidental deletion while allowing administrators to manage resources?' would make this option correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a custom RBAC role with only the required VM power actions and assign it at the resource group scope.Correct answer▾
Why this is correct
A custom role is appropriate when the built-in roles are broader than the actual task. By granting only the VM start, stop, and restart actions needed for that resource group, the administrator keeps permissions tightly limited. Assigning the role at the resource group scope also ensures the team cannot affect resources outside that application boundary.
✗Assign Contributor at the subscription scope so the team can manage all resources.Wrong answer — click to see why▾
Why this is wrong here
Assigning Contributor at the subscription scope grants far too many permissions, including the ability to create, delete, and modify VMs, disks, and networking, which violates the requirement to restrict those actions.
★ When this WOULD be the correct answer
This option would be correct if the question required the team to have full management capabilities over all resources in the subscription, including creating and deleting VMs, modifying disks, and managing networking, without any restrictions.
Why candidates choose this
Candidates may think Contributor is a safe role that allows management without full admin rights, but they overlook that it includes permissions beyond the specific VM power actions needed.
✗Assign Reader at the resource group scope and use Azure Policy to permit VM restarts.Wrong answer — click to see why▾
Why this is wrong here
Reader role does not allow any write actions, including VM start/stop/restart, and Azure Policy cannot grant permissions—it only enforces compliance. Thus, this combination cannot provide the required power management capabilities.
★ When this WOULD be the correct answer
If the question required preventing unauthorized modifications while allowing read access, and the team needed to view VM status but not perform any actions, then assigning Reader at the resource group scope would be correct. Azure Policy could be used to audit or enforce settings, not to grant permissions.
Why candidates choose this
Candidates may mistakenly believe that Azure Policy can override RBAC to grant specific actions, or think that combining Reader with Policy can selectively allow operations, not realizing that Policy only controls configuration compliance, not permissions.
✗Apply a resource lock to the resource group so the team can only make approved changes.Wrong answer — click to see why▾
Why this is wrong here
A resource lock prevents deletion or modification of resources but does not grant permissions to start, stop, or restart VMs; it only blocks changes, so the team would have no ability to perform the required actions.
★ When this WOULD be the correct answer
In a scenario where the goal is to prevent accidental deletion or modification of critical resources while still allowing authorized users to manage them via RBAC, a resource lock would be correct. For example, a question asking 'How to protect a resource group from accidental deletion while allowing administrators to manage resources?' would make this option correct.
Why candidates choose this
Candidates may confuse resource locks with access control, thinking that locking the resource group somehow permits specific actions like VM restarts, or they may believe locks can be used to enforce allowed operations.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.