AZ-104 Manage Azure Identities and Governance Practice Question
A team in RG-Apps must be able to start, stop, and deallocate virtual machines and read their properties. Built-in roles available to the team are broader than necessary. What should the administrator do?
⚠ Common exam trap
Candidates often choose Virtual Machine Contributor (Option A or C) thinking it covers start/stop/deallocate, but they overlook that it also includes broader VM management actions like create, delete, and modify, which violates the least-privilege requirement stated in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom role with only the required VM actions and assign it at RG-Apps scope.
The team needs specific actions (start, stop, deallocate, read properties) that are a subset of the Virtual Machine Contributor role's permissions. Creating a custom role with only the required actions (Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, Microsoft.Compute/virtualMachines/read, etc.) and assigning it at the RG-Apps scope provides least-privilege access without granting broader capabilities like creating or deleting VMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign Virtual Machine Contributor at the subscription scope.
Why it's wrong here
Assigning Virtual Machine Contributor at the subscription scope is overly broad in two ways. It grants the team the VM Contributor built-in role on every resource group in the entire subscription, including RG-Apps and any other RG, allowing them to manage and potentially delete VMs in unrelated workloads. Even though the scope is large, the built-in role still includes create/write/delete actions, so neither the scope nor the role is compatible with a start/stop/deallocate-only permission set.
When this WOULD be correct
If the question required the team to manage all VMs across multiple resource groups within the subscription, and the built-in Virtual Machine Contributor role exactly matched the needed permissions, then assigning it at subscription scope would be appropriate.
- ✓
Create a custom role with only the required VM actions and assign it at RG-Apps scope.
Why this is correct
A custom role can include only the required actions, such as VM start, deallocate, and read, without granting unnecessary permissions. Assigning the role at RG-Apps scope keeps the permissions limited to the target resource group and is the cleanest least-privilege design.
- ✗
Assign Reader and Virtual Machine Contributor together at the resource group scope.
Why it's wrong here
Combining Reader with Virtual Machine Contributor at RG-Apps scope still violates least privilege. Virtual Machine Contributor includes Microsoft.Compute/virtualMachines/write, delete, and create operations, so the team could modify or remove VMs, not just start/stop/deallocate; Reader also grants broad read access to every resource in the resource group, which is unnecessary for the task. A custom role limited to the start, powerOff/deallocate, and read actions is the only way to meet the requirement.
When this WOULD be correct
This combination would be correct if the team needed to both read VM properties (Reader) and perform all VM management actions including create/delete (Virtual Machine Contributor) at the resource group scope.
- ✗
Assign Owner at the resource group scope to avoid troubleshooting access issues.
Why it's wrong here
Owner at the resource group scope is a serious over-privilege because it provides full management control, including the ability to delete RG-Apps and all resources inside it, manage resource locks, and assign roles to other users. Using Owner 'to avoid troubleshooting access issues' is unacceptable because least privilege requires the team to have only the specific VM lifecycle actions, and Owner also grants User Access Administrator-like permission to change permissions on the resource group. This creates a security risk and exceeds the team's functional needs.
When this WOULD be correct
A scenario where the team needs full administrative control over the resource group, including the ability to manage access and all resource operations, and the principle of least privilege is not a concern.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a custom role with only the required VM actions and assign it at RG-Apps scope.Correct answer▾
Why this is correct
A custom role can include only the required actions, such as VM start, deallocate, and read, without granting unnecessary permissions. Assigning the role at RG-Apps scope keeps the permissions limited to the target resource group and is the cleanest least-privilege design.
✗Assign Virtual Machine Contributor at the subscription scope.Wrong answer — click to see why▾
Why this is wrong here
Virtual Machine Contributor at subscription scope grants broader permissions than needed, including the ability to manage VMs beyond the RG-Apps resource group, violating the principle of least privilege.
★ When this WOULD be the correct answer
If the question required the team to manage all VMs across multiple resource groups within the subscription, and the built-in Virtual Machine Contributor role exactly matched the needed permissions, then assigning it at subscription scope would be appropriate.
Why candidates choose this
Candidates may think Virtual Machine Contributor is the closest built-in role for VM management and assume subscription scope is acceptable because it's simpler than creating a custom role.
✗Assign Reader and Virtual Machine Contributor together at the resource group scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader and Virtual Machine Contributor together at the resource group scope grants more permissions than needed, including the ability to create and manage VMs, which exceeds the required start, stop, deallocate, and read properties actions.
★ When this WOULD be the correct answer
This combination would be correct if the team needed to both read VM properties (Reader) and perform all VM management actions including create/delete (Virtual Machine Contributor) at the resource group scope.
Why candidates choose this
Candidates may think combining Reader with Virtual Machine Contributor limits permissions to only read and start/stop/deallocate, but Virtual Machine Contributor includes broader VM management capabilities.
✗Assign Owner at the resource group scope to avoid troubleshooting access issues.Wrong answer — click to see why▾
Why this is wrong here
Assigning Owner at the resource group scope grants full control over all resources, including permissions management, which is far broader than the required start, stop, deallocate, and read properties actions.
★ When this WOULD be the correct answer
A scenario where the team needs full administrative control over the resource group, including the ability to manage access and all resource operations, and the principle of least privilege is not a concern.
Why candidates choose this
Candidates may think Owner is a simple way to avoid future access issues, overlooking that it provides excessive permissions beyond the required actions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID Users and Groups
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
Contributor role
The Contributor role is a built-in Azure role that grants full access to manage resources within a scope but does not allow granting access to other users.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.