An operations team needs to start and deallocate every virtual machine in RG-App and read VM settings, but they must not be able to delete VMs or manage networking resources. What is the best Azure RBAC solution?

Assign the Virtual Machine Contributor role at the subscription scope

This grants more permission than needed and affects all resource groups in the subscription.

Assign the Reader role at the resource group scope

Reader allows viewing resources only and does not permit starting or stopping virtual machines.

Assign the Owner role at the resource group scope

Owner is far broader than required and includes delete and permission-management capabilities.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create a custom role and assign it at the RG-App resource group scope — The requirement is a classic least-privilege case where a built-in role is too permissive or too restrictive. Virtual Machine Contributor includes more actions than the team needs, while Reader does not allow operations such as start or deallocate. A custom role lets the administrator define only the required compute actions and assign that role at the RG-App scope. This prevents access to networking and delete operations while still supporting daily operations. Why others are wrong: Virtual Machine Contributor is broader than the stated need and may permit changes the team should not make. Reader is view-only and cannot perform operational actions on VMs. Owner is the most excessive option because it includes full control, delete permissions, and role assignment rights. A custom role is the only option that precisely matches the requirement and preserves least privilege.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.