AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Current assignments for RG-App: - HelpDeskGroup -> Reader - PlatformAdmins -> Contributor Business requirement: - HelpDeskGroup can start, stop, and restart VMs only - HelpDeskGroup must not manage NICs, disks, or other resources
Based on the exhibit, the help desk team must be able to restart virtual machines in RG-App, but they must not be able to create, delete, or resize VMs. What is the best action?
⚠ Common exam trap
Candidates often assume the built-in Virtual Machine Contributor role is the correct choice because it sounds restrictive, but it actually includes write permissions that allow VM creation and deletion, making a custom role necessary for the exact set of actions required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom RBAC role that allows VM start, restart, and deallocate actions, then assign it at RG-App.
The help desk team needs only specific actions (start, restart, deallocate) without the ability to create, delete, or resize VMs. The built-in Virtual Machine Contributor role includes write permissions that allow creating and deleting VMs, so a custom RBAC role that explicitly grants only the required actions (Microsoft.Compute/virtualMachines/start/action, restart/action, deallocate/action) and is assigned at the RG-App scope meets the requirement precisely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign Virtual Machine Contributor to HelpDeskGroup at the subscription scope.
Why it's wrong here
Assigning Virtual Machine Contributor at subscription scope extends permissions across the entire subscription, not just RG-App, and the role itself grants more than needed—including creating and deleting VMs, managing extensions, and modifying VM configurations. This violates least privilege because the help desk only needs start, restart, and deallocate actions on specific VMs, not full VM management across all resources. Also, at subscription scope it would also allow managing disks, network interfaces, and other VM dependencies in other resource groups.
When this WOULD be correct
If the requirement were to allow full VM management (including create, delete, resize) across all resource groups in the subscription, then assigning Virtual Machine Contributor at subscription scope would be appropriate.
- ✗
Assign Contributor to HelpDeskGroup at RG-App.
Why it's wrong here
Contributor at RG-App provides full management access to every resource type within the resource group, allowing the help desk to create, delete, and modify not just VMs but also virtual networks, storage accounts, and any other Azure resources. Unlike a custom role limited to specific VM actions, Contributor includes actions for all resource providers, so it is far broader than the required start/restart/deallocate operations. This broad control could be abused to alter infrastructure in unintended ways, exceeding the help desk's job responsibilities.
When this WOULD be correct
If the requirement were to allow the help desk team full management of all resources in RG-App except for access control, and the question did not restrict VM creation, deletion, or resizing, then assigning Contributor at RG-App would be appropriate.
- ✓
Create a custom RBAC role that allows VM start, restart, and deallocate actions, then assign it at RG-App.
Why this is correct
A custom role is the best fit when no built-in role is narrow enough. Assigning it at the resource group scope limits the permission to RG-App, while the role itself can be restricted to only the VM operational actions that the help desk needs.
- ✗
Assign Owner to HelpDeskGroup at RG-App and use Azure Policy to block unwanted changes.
Why it's wrong here
Owner at RG-App grants full access, including the ability to manage role assignments and alter policy definitions, which means the help desk could grant themselves even more permissions or remove the very policy intended to constrain them. Azure Policy only applies compliance rules to resource operations; it does not shrink the effective RBAC permissions a role grants, so combining Owner with policy is not a least-privilege solution. Because Owner can also delete resources and modify access control, it leaves the environment exposed to excessive changes.
When this WOULD be correct
This option would be correct if the requirement were to give a group full administrative control over a resource group while using Azure Policy to enforce compliance rules (e.g., tagging or location restrictions) that do not conflict with the group's permissions.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a custom RBAC role that allows VM start, restart, and deallocate actions, then assign it at RG-App.Correct answer▾
Why this is correct
A custom role is the best fit when no built-in role is narrow enough. Assigning it at the resource group scope limits the permission to RG-App, while the role itself can be restricted to only the VM operational actions that the help desk needs.
✗Assign Virtual Machine Contributor to HelpDeskGroup at the subscription scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning Virtual Machine Contributor at subscription scope grants permission to create, delete, and resize VMs across all resource groups, which exceeds the required restriction of preventing these actions.
★ When this WOULD be the correct answer
If the requirement were to allow full VM management (including create, delete, resize) across all resource groups in the subscription, then assigning Virtual Machine Contributor at subscription scope would be appropriate.
Why candidates choose this
Candidates may think Virtual Machine Contributor is a narrowly scoped role for VMs, but they overlook that it includes write/delete permissions, which are prohibited in this scenario.
✗Assign Contributor to HelpDeskGroup at RG-App.Wrong answer — click to see why▾
Why this is wrong here
The Contributor role at RG-App includes write and delete permissions on all resources, which would allow the help desk team to create, delete, or resize VMs, violating the requirement.
★ When this WOULD be the correct answer
If the requirement were to allow the help desk team full management of all resources in RG-App except for access control, and the question did not restrict VM creation, deletion, or resizing, then assigning Contributor at RG-App would be appropriate.
Why candidates choose this
Candidates may think Contributor provides sufficient permissions for restarting VMs without realizing it also grants broader management capabilities that exceed the stated restrictions.
✗Assign Owner to HelpDeskGroup at RG-App and use Azure Policy to block unwanted changes.Wrong answer — click to see why▾
Why this is wrong here
Assigning Owner at RG-App grants full control, including the ability to create, delete, and resize VMs, which violates the requirement to prevent those actions. Azure Policy can block some changes but does not restrict RBAC permissions, so the help desk would still have excessive rights.
★ When this WOULD be the correct answer
This option would be correct if the requirement were to give a group full administrative control over a resource group while using Azure Policy to enforce compliance rules (e.g., tagging or location restrictions) that do not conflict with the group's permissions.
Why candidates choose this
Candidates may think that combining Owner with Azure Policy provides a flexible way to grant broad permissions while using policy to block specific actions, not realizing that Owner overrides policy restrictions on RBAC actions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID Users and Groups
Key term
Contributor role
The Contributor role is a built-in Azure role that grants full access to manage resources within a scope but does not allow granting access to other users.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.