Azure RBAC Role Assignment Scope: Resource Group Inheritance
You want to let a support engineer restart only the virtual machines in the Prod-Apps resource group, and any VM added later to that group should also be covered. Where should you assign the role?
Quick Answer
The answer is to assign the role at the Prod-Apps resource group scope. This is correct because Azure RBAC role assignments are inherited by all child resources within that scope, meaning the 'Virtual Machine Contributor' role will apply to every VM currently in the group and any VM added later, automatically covering the requirement for dynamic resource management. On the AZ-104 exam, this tests your understanding of inheritance hierarchy and the principle of assigning roles at the highest practical scope to minimize administrative overhead. A common trap is assigning the role at the subscription level, which would grant overly broad permissions, or at the individual VM level, which would require manual updates for each new VM. Remember the memory tip: "Scope it to the group, and the group will scope it for you"—always think of resource group inheritance as a single point of control for a collection of resources.
⚠ Common exam trap
Test-takers frequently confuse scope inheritance with the need to assign roles at the subscription level to cover future resources, not realizing that resource group scope inheritance already covers all current and future child resources within that group.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
At the Prod-Apps resource group scope, because the assignment will inherit to all VMs in that group.
Assigning the 'Virtual Machine Contributor' role at the Prod-Apps resource group scope ensures that the support engineer can restart all current and future VMs within that group. Role assignments in Azure RBAC are inherited by all child resources, so any VM added later to the resource group automatically receives the same permissions. This is the most efficient and maintainable approach for managing access to a dynamic set of resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
At the subscription scope, because it will cover the resource group and future VMs.
Why it's wrong here
This is broader than needed and grants access to unrelated resource groups in the subscription.
When this WOULD be correct
If the requirement were to allow the support engineer to restart VMs across multiple resource groups within the subscription (e.g., all VMs in the subscription), then assigning the role at the subscription scope would be correct.
- ✓
At the Prod-Apps resource group scope, because the assignment will inherit to all VMs in that group.
Why this is correct
This is correct because the resource group is the narrowest scope that still covers all VMs in Prod-Apps, including any future VMs created there. Assigning the role at the group scope keeps access limited to the intended set of resources while still taking advantage of Azure RBAC inheritance for child resources.
- ✗
At each VM resource scope, because role assignments never inherit.
Why it's wrong here
This is incorrect because Azure RBAC does inherit from resource group scope to child resources. Per-VM assignments would create unnecessary administrative overhead.
When this WOULD be correct
If the question required granting a role to a specific VM only, with no inheritance to other VMs, and explicitly stated that role assignments do not inherit (e.g., a custom scenario where inheritance is blocked), then assigning at the VM scope would be correct.
- ✗
At the management group scope, because it is the only scope that applies to VMs.
Why it's wrong here
This is incorrect because management group scope is far too broad for a single resource group and is not required for this task.
When this WOULD be correct
If the requirement was to allow the support engineer to restart VMs across multiple subscriptions (e.g., all subscriptions under a management group), and any new subscriptions added to that management group should also be covered, then assigning the role at the management group scope would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓At the Prod-Apps resource group scope, because the assignment will inherit to all VMs in that group.Correct answer▾
Why this is correct
This is correct because the resource group is the narrowest scope that still covers all VMs in Prod-Apps, including any future VMs created there. Assigning the role at the group scope keeps access limited to the intended set of resources while still taking advantage of Azure RBAC inheritance for child resources.
✗At the subscription scope, because it will cover the resource group and future VMs.Wrong answer — click to see why▾
Why this is wrong here
Assigning the role at the subscription scope would grant the support engineer restart permissions on all VMs in the subscription, not just those in the Prod-Apps resource group, violating the principle of least privilege.
★ When this WOULD be the correct answer
If the requirement were to allow the support engineer to restart VMs across multiple resource groups within the subscription (e.g., all VMs in the subscription), then assigning the role at the subscription scope would be correct.
Why candidates choose this
Candidates may think that assigning at a higher scope (subscription) is simpler and still covers the resource group and future VMs, overlooking the broader access it grants.
✗At each VM resource scope, because role assignments never inherit.Wrong answer — click to see why▾
Why this is wrong here
Role assignments in Azure do inherit to child resources, so assigning at each VM scope is unnecessary and violates the requirement that future VMs added to the resource group are automatically covered.
★ When this WOULD be the correct answer
If the question required granting a role to a specific VM only, with no inheritance to other VMs, and explicitly stated that role assignments do not inherit (e.g., a custom scenario where inheritance is blocked), then assigning at the VM scope would be correct.
Why candidates choose this
Candidates may mistakenly believe that role assignments do not inherit in Azure, or they may think that assigning at the resource level is the only way to ensure precise control, overlooking the inheritance mechanism.
✗At the management group scope, because it is the only scope that applies to VMs.Wrong answer — click to see why▾
Why this is wrong here
Assigning at the management group scope would apply the role to all subscriptions and resource groups under that management group, not just the Prod-Apps resource group, thus granting broader permissions than intended.
★ When this WOULD be the correct answer
If the requirement was to allow the support engineer to restart VMs across multiple subscriptions (e.g., all subscriptions under a management group), and any new subscriptions added to that management group should also be covered, then assigning the role at the management group scope would be correct.
Why candidates choose this
Candidates may think management group scope is the most efficient way to cover future resources, but they overlook that it applies to a wider hierarchy than just a single resource group.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A support engineer must restart and view the properties of virtual machines only in RG-Dev. The engineer must not gain access to other resource groups in the subscription. What should the administrator do?
medium- A.Assign the Reader role at the subscription scope and the Virtual Machine Contributor role at RG-Dev scope.
- ✓ B.Assign the Virtual Machine Contributor role at the RG-Dev scope.
- C.Assign the Contributor role at the RG-Dev scope.
- D.Create a custom role at the subscription scope and assign it to the engineer.
Why B: The Virtual Machine Contributor role at the RG-Dev scope grants the engineer the necessary permissions to restart and view properties of virtual machines within that resource group, while restricting access to other resource groups. This role includes actions like Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/read, which cover the required tasks without granting broader management rights.
Variation 2. A support engineer must start, stop, and restart only one virtual machine named vm-app01. The engineer should not gain permissions on any other virtual machine in the subscription. What is the best scope for the role assignment?
medium- A.The entire subscription that contains vm-app01.
- B.The resource group that contains vm-app01.
- ✓ C.The vm-app01 virtual machine resource itself.
- D.The management group that contains the subscription.
Why C: Azure RBAC allows role assignments to be scoped to individual resources, such as a specific virtual machine. By assigning a role like 'Virtual Machine Contributor' at the vm-app01 resource scope, the support engineer will have permissions to start, stop, and restart only that VM, and no other resources in the subscription or resource group.
Variation 3. An operations team needs to let helpdesk staff restart virtual machines and view their properties only in RG-Dev. The staff must not be able to manage virtual networks, disks, or delete any resources. What is the best built-in role assignment?
medium- A.Assign Reader at the subscription scope so the staff can view the VMs.
- ✓ B.Assign Virtual Machine Contributor at the RG-Dev scope.
- C.Assign Contributor at the RG-Dev scope.
- D.Assign Virtual Machine Administrator Login at the RG-Dev scope.
Why B: The built-in Virtual Machine Contributor role grants full control over virtual machines, including restart, read, write, and delete. It does prevent managing virtual networks and disks, but it does not prevent deletion of VMs. Since the requirement explicitly forbids deleting any resources, this role does not meet the need. No built-in role exactly matches restart + read with no delete; a custom role would be required.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.