A team in RG-Apps must be able to start, stop, and deallocate virtual machines and read their properties. Built-in roles available to the team are broader than necessary. What should the administrator do?

Assign Virtual Machine Contributor at the subscription scope.

This would grant VM management rights across the entire subscription, which is broader than the requirement.

Assign Reader and Virtual Machine Contributor together at the resource group scope.

Combining built-in roles still grants more permissions than needed and does not reduce the VM management surface area.

Assign Owner at the resource group scope to avoid troubleshooting access issues.

Owner grants full control, including permission management and deletion, which is far more access than the team needs.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create a custom role with only the required VM actions and assign it at RG-Apps scope. — A custom role is the right choice when built-in roles are too broad for the required task. In this case, the team only needs a small subset of VM permissions, so the administrator should define a role with just the needed Microsoft.Compute actions and assign it at the resource group scope. That approach reduces risk, avoids accidental changes, and satisfies least privilege without granting delete or network control permissions. Why others are wrong: Assigning Virtual Machine Contributor at subscription scope expands the permission boundary to every resource group in the subscription. Combining Reader with Virtual Machine Contributor does not make the access narrower; it still inherits the broader VM management permissions. Owner is the opposite of least privilege because it provides unrestricted control, including access management and deletion rights, which are not part of the business need.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.