An operations team needs to let helpdesk staff restart virtual machines and view their properties only in RG-Dev. The staff must not be able to manage virtual networks, disks, or delete any resources. What is the best built-in role assignment?

Assign Reader at the subscription scope so the staff can view the VMs.

Reader lets users view resource settings, but it does not allow restart actions on virtual machines.

Assign Contributor at the RG-Dev scope.

Contributor can manage all resources in the resource group, including networking and deletion, which is broader than required.

Assign Virtual Machine Administrator Login at the RG-Dev scope.

Virtual Machine Administrator Login controls guest OS sign-in, not Azure management actions like restarting or viewing resource properties.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Assign Virtual Machine Contributor at the RG-Dev scope. — Virtual Machine Contributor is the best built-in role because it lets staff manage virtual machine operations without granting full control over the resource group. Placing the assignment at RG-Dev scope keeps the permission boundary narrow and prevents access to unrelated resources elsewhere in the subscription. This aligns with least privilege and avoids granting rights to network configuration or resource deletion beyond what the team needs. Why others are wrong: Reader is too limited because it only permits viewing, not restarting VMs. Contributor is too broad because it includes management of every resource in the resource group, which violates the requirement to avoid network and delete permissions. Virtual Machine Administrator Login is not an Azure RBAC management role for VM operations; it only affects how a user signs in to the guest operating system.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.