AZ-104 Manage Azure Identities and Governance Practice Question
You need to ensure that a contractor can manage virtual machines only in the RG-Test resource group and cannot access any other resource groups in the subscription. What is the best way to achieve this?
⚠ Common exam trap
Many exam-takers confuse the Virtual Machine Contributor role with broader roles like Contributor or Owner, or incorrectly assume that a subscription-scoped assignment can be restricted by resource group, when in fact Azure RBAC permissions are cumulative and inherited from higher scopes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the Virtual Machine Contributor role at the RG-Test scope
Assigning the Virtual Machine Contributor role at the RG-Test scope grants the contractor permissions to manage virtual machines within that specific resource group only, adhering to the principle of least privilege. This role includes actions like creating, starting, stopping, and deleting VMs, but does not allow access to other resource groups in the subscription because the role assignment is scoped to RG-Test.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the Virtual Machine Contributor role at the subscription scope
Why it's wrong here
Assigning Virtual Machine Contributor at the subscription scope gives the contractor VM management permissions over every resource group in the entire subscription, not just RG-Test. This broad scope would allow the contractor to start, stop, restart, or delete virtual machines in production environments, development environments, or any other resource group containing sensitive workloads. The requirement explicitly states management only for VMs in RG-Test, so a subscription-level assignment is overly permissive and creates an unnecessary blast radius, violating the principle of least privilege by extending access well beyond the needed boundary.
When this WOULD be correct
This option would be correct if the requirement was to allow the contractor to manage virtual machines across all resource groups in the subscription, without any restriction to a specific resource group.
- ✓
Assign the Virtual Machine Contributor role at the RG-Test scope
Why this is correct
Assigning the Virtual Machine Contributor role at the RG-Test scope is the correct choice because this built-in role includes exactly the actions needed to manage VMs (create, start, stop, restart, delete) while excluding the ability to read or write other resource types. Scoping the assignment to RG-Test limits the contractor's effective permissions to only that resource group, so they cannot affect VMs in other resource groups. This adheres to least privilege by granting only the management capabilities relevant to the contractor's job without exposing unrelated resources.
- ✗
Assign the Reader role at the RG-Test scope
Why it's wrong here
The Reader role at the RG-Test scope provides read-only visibility into all resources in the resource group, including virtual machine properties, metrics, and configuration. It does not include any actions that allow creating, starting, stopping, restarting, or deleting VMs, so it fails to meet the requirement for management. Moreover, Reader can still access secrets, keys, and connection strings if those are stored on disks or linked resources, which makes it an insecure choice if the contractor truly needs to perform operational changes.
When this WOULD be correct
If the requirement were to allow the contractor to view (but not modify) virtual machines and their properties in RG-Test, while preventing any changes, then the Reader role at the RG-Test scope would be correct.
- ✗
Assign the Owner role at the RG-Test scope
Why it's wrong here
The Owner role at the RG-Test scope grants full administrative control over every resource in that resource group, including read/write/delete permissions and, critically, the 'Microsoft.Authorization/roleAssignments/write' action that enables assigning roles to themselves or others. This is far more than the contractor requires, because it allows them to modify permissions, escalate their own privileges, or delete the resource group and all its resources. Even though it is scoped to RG-Test, Owner violates least privilege and introduces an unacceptable security risk compared to the focused Virtual Machine Contributor role.
When this WOULD be correct
Assign the Owner role at the RG-Test scope would be correct if the requirement is to grant a contractor full control over all resources in that resource group, including managing role assignments and deleting resources, without access to other resource groups.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign the Virtual Machine Contributor role at the RG-Test scopeCorrect answer▾
Why this is correct
Assigning the Virtual Machine Contributor role at the RG-Test scope is the correct choice because this built-in role includes exactly the actions needed to manage VMs (create, start, stop, restart, delete) while excluding the ability to read or write other resource types. Scoping the assignment to RG-Test limits the contractor's effective permissions to only that resource group, so they cannot affect VMs in other resource groups. This adheres to least privilege by granting only the management capabilities relevant to the contractor's job without exposing unrelated resources.
✗Assign the Virtual Machine Contributor role at the subscription scopeWrong answer — click to see why▾
Why this is wrong here
Assigning the Virtual Machine Contributor role at the subscription scope grants the contractor access to all virtual machines in the subscription, including those outside RG-Test, violating the requirement to restrict access to only RG-Test.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to allow the contractor to manage virtual machines across all resource groups in the subscription, without any restriction to a specific resource group.
Why candidates choose this
Candidates may mistakenly think that assigning a role at a higher scope (subscription) is simpler and still effective, overlooking that it grants broader access than intended.
✗Assign the Reader role at the RG-Test scopeWrong answer — click to see why▾
Why this is wrong here
The Reader role only allows read access, not the ability to manage virtual machines (e.g., create, delete, or modify VMs). The contractor needs to manage VMs, which requires a contributor-level role.
★ When this WOULD be the correct answer
If the requirement were to allow the contractor to view (but not modify) virtual machines and their properties in RG-Test, while preventing any changes, then the Reader role at the RG-Test scope would be correct.
Why candidates choose this
Candidates may confuse 'manage' with 'view' or think that read access is sufficient for oversight tasks, not realizing that management implies write/delete permissions.
✗Assign the Owner role at the RG-Test scopeWrong answer — click to see why▾
Why this is wrong here
The Owner role grants full access to all resources in the scope, including the ability to manage access and delete resources, which exceeds the requirement to only manage virtual machines and violates the principle of least privilege.
★ When this WOULD be the correct answer
Assign the Owner role at the RG-Test scope would be correct if the requirement is to grant a contractor full control over all resources in that resource group, including managing role assignments and deleting resources, without access to other resource groups.
Why candidates choose this
Candidates may think Owner is necessary to manage virtual machines effectively, or they may confuse the broad permissions needed for VM management with the actual scope of the Virtual Machine Contributor role.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Role assignment
Role assignment is the process of granting a specific set of permissions to a user, group, or service principal so they can perform certain actions within a system.
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.