AZ-900 Describe Azure management and governance Practice Question
A company needs to grant a group of users the ability to restart and start/stop virtual machines, but not to create or delete them. They want to assign this permission at the resource group level. What should they do?
⚠ Common exam trap
Many exam-takers assume the Virtual Machine Contributor role (Option C) is sufficient for start/stop operations, but they overlook that it also includes write permissions that allow VM creation and deletion, which violates the requirement to restrict those actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom role with the required actions
Azure's built-in roles do not provide a granular permission set that allows restarting and starting/stopping VMs while explicitly denying creation and deletion. A custom role must be created with specific actions such as 'Microsoft.Compute/virtualMachines/start/action', 'Microsoft.Compute/virtualMachines/restart/action', and 'Microsoft.Compute/virtualMachines/deallocate/action', and exclude actions like 'Microsoft.Compute/virtualMachines/write' and 'Microsoft.Compute/virtualMachines/delete'. This custom role can then be assigned at the resource group scope to grant the precise permissions required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the built-in Contributor role
Why it's wrong here
The built-in Contributor role grants all management operations on all resource types, including creating, deleting, and modifying resources, and can also assign permissions to others. Assigning it for start/restart/stop exceeds the necessary scope and violates the principle of least privilege, leaving the group with far more power than intended.
When this WOULD be correct
If the requirement were to grant full management access to all resources in the resource group, including creating and deleting VMs, then the built-in Contributor role would be appropriate.
- ✓
Create a custom role with the required actions
Why this is correct
Creating a custom role with only the required actions—Microsoft.Compute/virtualMachines/start/action, /restart/action, and /deallocate/action—is the least-privilege solution. This role can be scoped to a resource group or subscription and assigned to the specific group, granting exactly the operational control needed without allowing resource creation, deletion, or other management tasks.
- ✗
Assign the built-in Virtual Machine Contributor role
Why it's wrong here
The built-in Virtual Machine Contributor role does include VM start, restart, and deallocate permissions, but it also includes broader management capabilities such as creating and deleting VMs, managing VM extensions, and writing to disks and network interfaces. This exceed the narrow set of actions requested, making it overprivileged compared to a custom role.
When this WOULD be correct
A question that asks for granting full management of virtual machines (including creation and deletion) at the resource group level, without needing to manage other resources like networking or storage.
- ✗
Use Azure Policy to restrict operations
Why it's wrong here
Azure Policy is a governance and compliance service that enforces rules on resource configuration (e.g., allowed locations, required tags) during deployment and audit, but it does not control which users can perform actions such as start, restart, or stop. Access decisions are made by Azure RBAC, not Policy, so it is the wrong mechanism for user permissions.
When this WOULD be correct
If the question asked how to prevent users from creating or deleting VMs while allowing other operations, Azure Policy could be used to deny create/delete actions via a custom policy definition.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a custom role with the required actionsCorrect answer▾
Why this is correct
Creating a custom role with only the required actions—Microsoft.Compute/virtualMachines/start/action, /restart/action, and /deallocate/action—is the least-privilege solution. This role can be scoped to a resource group or subscription and assigned to the specific group, granting exactly the operational control needed without allowing resource creation, deletion, or other management tasks.
✗Assign the built-in Contributor roleWrong answer — click to see why▾
Why this is wrong here
The Contributor role grants full management access, including the ability to create and delete resources, which exceeds the requirement to only restart and start/stop VMs.
★ When this WOULD be the correct answer
If the requirement were to grant full management access to all resources in the resource group, including creating and deleting VMs, then the built-in Contributor role would be appropriate.
Why candidates choose this
Candidates may mistakenly believe that Contributor is a limited role, or they may not fully understand the scope of permissions it includes, leading them to think it fits the requirement.
✗Assign the built-in Virtual Machine Contributor roleWrong answer — click to see why▾
Why this is wrong here
The Virtual Machine Contributor role allows full management of virtual machines, including creating and deleting them, which exceeds the required permission to only restart and start/stop VMs without creating or deleting.
★ When this WOULD be the correct answer
A question that asks for granting full management of virtual machines (including creation and deletion) at the resource group level, without needing to manage other resources like networking or storage.
Why candidates choose this
Candidates may assume that the Virtual Machine Contributor role is narrowly scoped to VM operations, but it actually includes create/delete permissions, which are not desired in this scenario.
✗Use Azure Policy to restrict operationsWrong answer — click to see why▾
Why this is wrong here
Azure Policy is used to enforce compliance rules across resources, not to grant permissions. It cannot assign the ability to restart or start/stop VMs; it only restricts or audits configurations.
★ When this WOULD be the correct answer
If the question asked how to prevent users from creating or deleting VMs while allowing other operations, Azure Policy could be used to deny create/delete actions via a custom policy definition.
Why candidates choose this
Candidates may confuse Azure Policy with RBAC, thinking it can control who can perform actions, when it actually controls resource configurations and compliance.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.