A company has a single Azure subscription that contains multiple resource groups for different departments. The security team needs to ensure that only members of the 'VM Operators' Azure Active Directory group can create virtual machines in the subscription. All other users, including subscription Owners, must be blocked from creating virtual machines. Which Azure feature should the security team use to enforce this requirement?

Azure Policy with a deny effect

Incorrect. Azure Policy with a deny effect can block resource creation based on resource properties (e.g., resource type, location, tags) but not based on the identity of the user performing the action. Policy does not inspect the user's group membership; it evaluates the resource properties at creation time.

Azure Resource Lock at the subscription level

Incorrect. A resource lock prevents resources from being deleted or modified, but it does not block the creation of new resources. Additionally, locks affect all users equally and cannot be scoped to specific user groups.

Azure Blueprints

Incorrect. Azure Blueprints is used to define and deploy a repeatable set of Azure resources and policies (e.g., ARM templates, RBAC assignments, policy assignments) for creating consistent environments. It does not enforce runtime permissions after deployment; it can assign RBAC roles, but the enforcement of who can create VMs is done by RBAC itself, not by Blueprints.

What does this AZ-900 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Azure role-based access control (RBAC) — Azure role-based access control (RBAC) allows you to grant or deny specific permissions to users, groups, or service principals by assigning roles. In this scenario, the security team can assign a custom RBAC role that includes the Microsoft.Compute/virtualMachines/write permission (or use a built-in role like Virtual Machine Contributor) to only the 'VM Operators' group, and use a deny assignment to block all other users, including Owners, from creating VMs. Azure Policy is used to enforce rules on resource properties (e.g., allowed locations, SKU sizes) but cannot control which user identity performs an operation. Azure Resource Lock prevents deletion or modification of resources but does not control who can create resources. Azure Blueprints is an orchestration tool for deploying consistent environments and does not enforce runtime permissions.

What should I do if I get this AZ-900 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.