AZ-900 Describe Azure management and governance Practice Question
Which Azure feature enables you to create custom roles with specific permissions when built-in RBAC roles do not meet your requirements?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Policy (which enforces compliance rules) with RBAC (which controls access permissions), leading candidates to select Azure Policy custom definitions instead of custom RBAC roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Custom RBAC role definitions
Custom RBAC role definitions allow you to create roles with granular permissions tailored to your specific needs when built-in roles are insufficient. This Azure feature uses JSON-based role definitions that specify actions, notActions, dataActions, and assignable scopes to control access to Azure resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure AD application permissions
Why it's wrong here
Azure AD application permissions are wrong because they are scoped to the Azure AD Graph, Microsoft Graph, or an application's own API surface, not to Azure resource management. They define OAuth2 scopes or app roles that describe what a service principal can do within Azure AD or a registered application's domain, such as reading directory data or calling an API. Custom RBAC role definitions operate at the Azure control plane, specifying operations like Microsoft.Compute/virtualMachines/start, so application permissions are an entirely different authorization model.
- ✓
Custom RBAC role definitions
Why this is correct
Custom RBAC role definitions are correct because Azure RBAC supports building your own roles when built-in roles lack the required granularity. A custom role is a JSON definition that specifies a list of allowed actions (and optionally NotActions) plus assignable scopes, and once it is assigned at a scope, it directly grants or denies access to Azure resource management operations. This is the only mechanism listed that actually defines a set of Azure resource permissions, which is precisely what the question asks for.
- ✗
Azure Policy custom definitions
Why it's wrong here
Azure Policy custom definitions are wrong because they do not control who can perform an action; they control whether a resource complies with an organization's rules, such as requiring tags or limiting allowed VM sizes. A custom policy evaluates resource properties and can block non-compliant deployments or apply remediation, but it never authenticates an identity or grants access permissions. Custom RBAC roles, in contrast, define the access that identities have to Azure resources, so policy definitions address a separate governance concern.
- ✗
Azure AD group membership rules
Why it's wrong here
Azure AD group membership rules are wrong because they determine how users are dynamically placed into groups based on attributes like department, title, or location. These rules operate at the Azure AD identity layer, and while a group can later be assigned an RBAC role, the membership rule itself does not enumerate any resource permissions. Custom RBAC role definitions directly enumerate actions on Azure resources, so a dynamic membership rule is not a substitute for defining what access a role allows.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.