AZ-104 Manage Azure Identities and Governance Practice Question
Your company has an Azure subscription named Prod-Sub. You create a custom role that allows users to restart virtual machines but not create, delete, or resize them. You need to ensure that members of the VMOperators group can use this custom role only for virtual machines in the RG-Prod resource group. What should you do?
⚠ Common exam trap
A common mix-up: candidates confuse the scope of role assignments, thinking a subscription-level assignment can be restricted by a condition, but Azure RBAC does not support conditions for built-in or custom roles without Azure Policy or attribute-based access control (ABAC), which is not mentioned in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the custom role to VMOperators at the RG-Prod scope.
Assigning the custom role at the RG-Prod scope restricts the role's permissions to only the virtual machines within that specific resource group. This meets the requirement that VMOperators can restart VMs but not create, delete, or resize them, and only within RG-Prod.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the custom role to VMOperators at the subscription scope.
Why it's wrong here
If the same custom role is assigned at the subscription scope, every VM, virtual network, and any resource in any resource group under the subscription inherits that restart permission, because role assignments propagate down the resource hierarchy. This is broader than the stated requirement, which only concerns VMs in RG-Prod, and it violates least privilege by giving VMOperators effective restart control over unrelated production environments. That unnecessary blast radius is why subscription-level assignment is incorrect.
When this WOULD be correct
This option would be correct if the requirement was to allow VMOperators to restart virtual machines across all resource groups within the subscription, without restricting to a specific resource group.
- ✓
Assign the custom role to VMOperators at the RG-Prod scope.
Why this is correct
Assigning the custom role at the RG-Prod resource group scope ensures the Microsoft.Compute/virtualMachines/restart/action permission applies only to VMs within that resource group. This follows the principle of least privilege because VMOperators receive exactly the restart capability and nothing else, with no ability to influence resources in other resource groups or subscriptions. The role assignment is scoped specifically to the resource group to support the business requirement for production VMs only.
- ✗
Assign the Virtual Machine Contributor role to VMOperators at the RG-Prod scope.
Why it's wrong here
Virtual Machine Contributor is a built-in role that allows full management of virtual machines, including create, delete, start, stop, restart, and also manage connected resources such as virtual networks, disks, and network interfaces. Scoping that role to RG-Prod still grants VMOperators far more than the required restart-only action, because the built-in role includes many high-privilege actions (for example Microsoft.Compute/virtualMachines/delete and Microsoft.Network/networkInterfaces/write). A custom role with only the restart action is the correct approach.
When this WOULD be correct
This option would be correct if the requirement was to allow VMOperators to fully manage virtual machines (create, delete, resize, restart) within RG-Prod, without needing custom roles.
- ✗
Assign the custom role to VMOperators at the management group scope.
Why it's wrong here
Assigning the custom role at a management group scope makes the permission effective across every subscription and resource group under that management group, not just RG-Prod. This propagates the restart permission to all child scopes, vastly exceeding the isolation requirement and increasing the potential attack surface across multiple subscriptions. Even though the custom role itself is narrow, the management group assignment applies it too broadly and is therefore not least privilege.
When this WOULD be correct
This option would be correct if the requirement was to allow VMOperators to restart VMs across all resource groups in all subscriptions under a specific management group, without needing to assign the role individually to each resource group or subscription.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign the custom role to VMOperators at the RG-Prod scope.Correct answer▾
Why this is correct
Assigning the custom role at the RG-Prod resource group scope ensures the Microsoft.Compute/virtualMachines/restart/action permission applies only to VMs within that resource group. This follows the principle of least privilege because VMOperators receive exactly the restart capability and nothing else, with no ability to influence resources in other resource groups or subscriptions. The role assignment is scoped specifically to the resource group to support the business requirement for production VMs only.
✗Assign the custom role to VMOperators at the subscription scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning the custom role at the subscription scope would grant the restart permission to all virtual machines in the subscription, not just those in RG-Prod, violating the requirement to scope the role only to RG-Prod.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to allow VMOperators to restart virtual machines across all resource groups within the subscription, without restricting to a specific resource group.
Why candidates choose this
Candidates may think that assigning at a higher scope (subscription) is simpler and still covers the target resource group, overlooking the need to restrict permissions to only that resource group.
✗Assign the Virtual Machine Contributor role to VMOperators at the RG-Prod scope.Wrong answer — click to see why▾
Why this is wrong here
The Virtual Machine Contributor role allows creating, deleting, and resizing VMs, which exceeds the required permission to only restart VMs. Assigning it at RG-Prod scope would grant broader permissions than intended.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to allow VMOperators to fully manage virtual machines (create, delete, resize, restart) within RG-Prod, without needing custom roles.
Why candidates choose this
Candidates may think Virtual Machine Contributor is a 'standard' role for VM operations and assume it only allows restart, overlooking its full permissions. They might also incorrectly believe that assigning at resource group scope automatically limits actions to restart only.
✗Assign the custom role to VMOperators at the management group scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning the custom role at the management group scope would apply the permission to all subscriptions and resource groups under that management group, not just RG-Prod, violating the requirement to restrict access to only that resource group.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to allow VMOperators to restart VMs across all resource groups in all subscriptions under a specific management group, without needing to assign the role individually to each resource group or subscription.
Why candidates choose this
Candidates may think that assigning at a higher scope (management group) is more efficient and still allows restriction via Azure Policy, but they overlook that role assignments at higher scopes apply to all child resources unless explicitly blocked, which is not the case here.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure subscription
An Azure subscription is a logical container in Microsoft Azure that provides billing isolation and access boundaries for your cloud resources and services.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.