AZ-104 Manage Azure Identities and Governance Practice Question
An operations team needs to start and deallocate every virtual machine in RG-App and read VM settings, but they must not be able to delete VMs or manage networking resources. What is the best Azure RBAC solution?
⚠ Common exam trap
Test-takers frequently choose Virtual Machine Contributor (Option A) because it seems to cover VM operations, but they overlook that it includes delete and networking management permissions, and that scoping at subscription level grants excessive access beyond the RG-App resource group.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom role and assign it at the RG-App resource group scope
The required permissions—starting, deallocating, and reading VM settings—are not fully covered by any built-in role, and the custom role must be scoped to RG-App to avoid granting broader access. A custom role allows combining Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/read, while explicitly excluding delete and networking management actions. Assigning at the resource group scope ensures the permissions apply only to resources within RG-App.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the Virtual Machine Contributor role at the subscription scope
Why it's wrong here
Assigning Virtual Machine Contributor at the subscription scope grants the operations team the ability to fully manage every virtual machine in all resource groups, including creating, deleting, and restarting VMs, not just starting and deallocating. This level of access extends beyond the required task and exposes the entire subscription to potential misconfiguration or excessive changes from a team that only needs lifecycle control. Additionally, Virtual Machine Contributor does not restrict actions to a single group, so the team could affect workloads outside RG-App, violating separation of duties.
When this WOULD be correct
If the requirement were to allow starting, deallocating, and managing VMs (including deletion and networking) for all VMs in a subscription, then assigning Virtual Machine Contributor at subscription scope would be appropriate.
- ✓
Create a custom role and assign it at the RG-App resource group scope
Why this is correct
Creating a custom role allows you to define exactly the required operations, such as Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/deallocate/action, along with read permission for the virtual machines. By assigning this role at the RG-App resource group scope, the operations team’s permissions are limited to that specific resource group, preventing any impact on other environments. This approach enforces least privilege: the team can start and deallocate VMs inside RG-App but cannot create, delete, or modify any other settings.
- ✗
Assign the Reader role at the resource group scope
Why it's wrong here
The Reader role is a read-only role that grants the ability to view resources but does not include any actions that change state, such as starting or deallocating virtual machines. Because start and deallocate operations are write/action calls in Azure Resource Manager, a reader cannot invoke them on any VM in the resource group. This role would let the operations team monitor VM status but leave them unable to perform the job function, making it clearly insufficient for the stated requirement.
When this WOULD be correct
If the requirement were only to read VM settings and not to start or deallocate VMs, assigning the Reader role at the resource group scope would be the best solution.
- ✗
Assign the Owner role at the resource group scope
Why it's wrong here
Owner is the most privileged built-in role, granting full control over all resources in the resource group, including deleting resources, modifying access control, and assigning permissions. This broad authority is far more than the operations team needs, as they are only required to start and deallocate virtual machines, and it creates a significant security risk if the team makes an unintended change. The role also allows role assignment changes, which could lead to privilege escalation or lockouts, and is therefore inappropriate for a narrowly scoped operational task.
When this WOULD be correct
Assign the Owner role at the resource group scope would be correct if the requirement was to grant full control over all resources in the resource group, including the ability to delete VMs and manage networking, with no restrictions.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a custom role and assign it at the RG-App resource group scopeCorrect answer▾
Why this is correct
Creating a custom role allows you to define exactly the required operations, such as Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/deallocate/action, along with read permission for the virtual machines. By assigning this role at the RG-App resource group scope, the operations team’s permissions are limited to that specific resource group, preventing any impact on other environments. This approach enforces least privilege: the team can start and deallocate VMs inside RG-App but cannot create, delete, or modify any other settings.
✗Assign the Virtual Machine Contributor role at the subscription scopeWrong answer — click to see why▾
Why this is wrong here
The Virtual Machine Contributor role at subscription scope grants permission to manage VMs but also allows deleting VMs and managing networking resources, which violates the requirement to prevent deletion and networking management.
★ When this WOULD be the correct answer
If the requirement were to allow starting, deallocating, and managing VMs (including deletion and networking) for all VMs in a subscription, then assigning Virtual Machine Contributor at subscription scope would be appropriate.
Why candidates choose this
Candidates may think Virtual Machine Contributor covers start/stop and reading settings, but overlook that it includes delete and networking permissions, and that subscription scope is broader than needed.
✗Assign the Reader role at the resource group scopeWrong answer — click to see why▾
Why this is wrong here
The Reader role allows reading VM settings but does not permit starting or deallocating VMs, which is required by the operations team.
★ When this WOULD be the correct answer
If the requirement were only to read VM settings and not to start or deallocate VMs, assigning the Reader role at the resource group scope would be the best solution.
Why candidates choose this
Candidates may think Reader is sufficient because it allows reading settings, but they overlook the need for start/deallocate actions, which require a role with Virtual Machine Contributor permissions.
✗Assign the Owner role at the resource group scopeWrong answer — click to see why▾
Why this is wrong here
The Owner role grants full access to all resources, including the ability to delete VMs and manage networking resources, which violates the requirement to prevent deletion and networking management.
★ When this WOULD be the correct answer
Assign the Owner role at the resource group scope would be correct if the requirement was to grant full control over all resources in the resource group, including the ability to delete VMs and manage networking, with no restrictions.
Why candidates choose this
Candidates may think Owner is necessary to start/stop VMs, not realizing that more restrictive roles like Contributor or custom roles can also perform these actions without granting excessive permissions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.