Manage Azure Identities and Governance →easyMultiple ChoiceObjective-mapped

AZ-104 Manage Azure Identities and Governance Practice Question

Exhibit

Azure portal notes

Automation account: aa-appops
Target resource group: RG-App
Required actions:
- Restart virtual machines
- Read virtual machine properties
- Read network interface properties
Not allowed:
- Delete any resource
- Modify network settings
- Manage resources outside RG-App

Current built-in role testing:
Virtual Machine Contributor = can restart VMs, but also can manage disks and extensions
Reader = can read resources, but cannot restart VMs

Based on the exhibit, an automation account must restart virtual machines and read network interface settings in RG-App. Built-in roles are too broad because they also allow actions the team does not want. What should the administrator do?

⚠ Common exam trap

It's easy for candidates to assume built-in roles like Reader or Virtual Machine Contributor are 'close enough' and overlook the need for custom roles to exclude unwanted write/delete actions, or they confuse management groups with a mechanism for fine-grained action filtering.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a custom role with only the required read and restart actions, then assign it at RG-App.

Built-in roles like Virtual Machine Contributor include actions beyond the required scope (e.g., write/delete operations), which the team wants to avoid. A custom role allows precise definition of only the needed actions: 'Microsoft.Compute/virtualMachines/restart/action' and 'Microsoft.Network/networkInterfaces/read'. Assigning this custom role at the RG-App scope ensures least privilege without exposing broader permissions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Assign the Reader role at RG-App, because reading permissions automatically include restart actions.
Why it's wrong here
Reader is too limited for this requirement. It allows viewing resources but does not permit restart actions on virtual machines. The note in the exhibit explicitly says Reader cannot restart VMs, so it cannot satisfy the automation account's task.
When this WOULD be correct
If the question required only read access to resources (e.g., monitoring configuration) and no write or action permissions, assigning the Reader role at the resource group scope would be correct.
✓
Create a custom role with only the required read and restart actions, then assign it at RG-App.
Why this is correct
A custom role is the correct solution when built-in roles are broader than needed. By defining only the required VM restart action and read permissions for the VM and network interface, the administrator can keep permissions tightly limited to RG-App and avoid unnecessary capabilities such as deletion or network changes.
✗
Assign Virtual Machine Contributor at the subscription scope so the automation account can reach all resources.
Why it's wrong here
Virtual Machine Contributor includes more permissions than needed, and subscription scope would extend those permissions to every resource group. That would violate the requirement to keep access confined to RG-App and to avoid deletion or broader management capabilities.
When this WOULD be correct
This option would be correct if the question required the automation account to manage all virtual machines across multiple resource groups within the subscription, and the team was comfortable with the full set of Virtual Machine Contributor permissions.
✗
Create a management group and move RG-App into it so only the needed actions are exposed.
Why it's wrong here
Management groups organize subscriptions for governance, but they do not reduce permissions in the way described here. Moving a resource group to a management group does not automatically create a narrow permission set. The access problem is solved by a custom RBAC role, not by hierarchy changes.
When this WOULD be correct
An administrator needs to apply a policy or compliance standard (e.g., requiring all resources in RG-App to have a specific tag) across multiple subscriptions. Creating a management group and moving RG-App into it allows the policy to be assigned at the management group scope, affecting all resources in that group.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

✓Create a custom role with only the required read and restart actions, then assign it at RG-App.Correct answer▾

Why this is correct

A custom role is the correct solution when built-in roles are broader than needed. By defining only the required VM restart action and read permissions for the VM and network interface, the administrator can keep permissions tightly limited to RG-App and avoid unnecessary capabilities such as deletion or network changes.

✗Assign the Reader role at RG-App, because reading permissions automatically include restart actions.Wrong answer — click to see why▾

Why this is wrong here

The Reader role provides read-only access and does not include restart actions, so assigning it at RG-App would not allow the automation account to restart VMs.

★ When this WOULD be the correct answer

If the question required only read access to resources (e.g., monitoring configuration) and no write or action permissions, assigning the Reader role at the resource group scope would be correct.

Why candidates choose this

Candidates may mistakenly believe that read permissions implicitly include restart actions, or they confuse the Reader role with a role that has broader permissions.

✗Assign Virtual Machine Contributor at the subscription scope so the automation account can reach all resources.Wrong answer — click to see why▾

Why this is wrong here

Assigning Virtual Machine Contributor at the subscription scope grants broader permissions than needed, including actions like creating and deleting VMs, which violates the requirement to restrict actions to only restart and read network interfaces.

★ When this WOULD be the correct answer

This option would be correct if the question required the automation account to manage all virtual machines across multiple resource groups within the subscription, and the team was comfortable with the full set of Virtual Machine Contributor permissions.

Why candidates choose this

Candidates may think that assigning a built-in role at a higher scope is simpler and still covers the required actions, overlooking the need for least privilege and the specific restriction against unwanted actions.

✗Create a management group and move RG-App into it so only the needed actions are exposed.Wrong answer — click to see why▾

Why this is wrong here

Creating a management group and moving RG-App into it does not restrict permissions; management groups are containers for organizing subscriptions and applying governance, not for scoping custom actions. The automation account still needs a role assignment with specific actions, which management groups do not provide.

★ When this WOULD be the correct answer

An administrator needs to apply a policy or compliance standard (e.g., requiring all resources in RG-App to have a specific tag) across multiple subscriptions. Creating a management group and moving RG-App into it allows the policy to be assigned at the management group scope, affecting all resources in that group.

Why candidates choose this

Candidates may think management groups can be used to isolate or limit permissions, confusing them with resource groups or scopes for role assignments. They might also believe moving a resource group into a management group automatically restricts actions, which is incorrect.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

AZ-104 Manage Azure Identities and Governance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question