AZ-900 Describe Azure management and governance Practice Question
An administrator needs to grant a user the ability to manage virtual machines in a specific resource group but NOT allow them to modify networking or storage. Which approach is BEST?
⚠ Common exam trap
Test-takers frequently confuse the Contributor role (which grants full management of all resources) with the more specific Virtual Machine Contributor role, or they mistakenly think Azure Policy can be used to restrict user permissions when it is actually a governance tool for enforcing resource compliance, not a substitute for RBAC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign Virtual Machine Contributor role scoped to the resource group
The Virtual Machine Contributor role provides exactly the permissions needed to manage virtual machines, including starting, stopping, and restarting them, but explicitly excludes access to the virtual network and storage account resources. By scoping this role to the specific resource group, the administrator ensures the user cannot modify networking or storage resources outside of the VM's operational scope. This is the most precise and secure approach because it follows the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign Owner role at the subscription level
Why it's wrong here
Assigning Owner at the subscription level grants full administrative access to every resource within the subscription, including the ability to assign roles to other users, manage networking, storage, and any VM. This is far too broad for a user who only needs to manage virtual machines, and it violates the principle of least privilege by enabling this user to change access permissions or modify unrelated resources.
- ✓
Assign Virtual Machine Contributor role scoped to the resource group
Why this is correct
Scoping the Virtual Machine Contributor role to the resource group grants the user exactly the permissions needed to manage virtual machines (create, start, stop, restart, delete, and manage extensions) while denying access to the underlying virtual network, storage accounts, and other resource group members. This is the correct implementation of least privilege because it restricts both the action scope (VM management only) and the resource scope (that specific resource group).
- ✗
Assign Contributor role at the resource group level
Why it's wrong here
Contributor at the resource group level provides full management rights to every resource in that resource group, including virtual networks, storage accounts, and any other services, but it does not allow role assignment. While this is scoped to a resource group, it is still too broad for someone who only needs to manage VMs, because the user could modify networking or storage, causing security or operational issues.
- ✗
Use Azure Policy to restrict the user's actions
Why it's wrong here
Azure Policy is a governance and compliance tool that enforces rules (e.g., allowed VM sizes, or requiring tags) on resources during creation and configuration; it does not grant any user permissions or allow a user to take management actions. It cannot give a specific user the ability to create or manage VMs, and it applies to all users across the scope. Role-based access control, not Azure Policy, is the mechanism for granting action permissions.
Go deeper
Related to this question
Learn chapter
Azure Resource Locks and Tags
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.