AZ-104 Question 19
Single answerYou are an Azure Administrator for a company that requires a group of developers to manage only the Virtual Machines within a specific resource group. The built-in roles either grant too many or too few permissions. What is the best way to give the developers exactly the permissions they need to manage VMs in that resource group?
- A
Create a custom role with the required VM actions and assign it to the group at the resource group scope.
- B
Assign the built-in Virtual Machine Contributor role at the subscription scope to the group.
- C
Enable RBAC on the resource group and assign the built-in Owner role to the group.
- D
Create an Azure Policy that allows only VM management actions and deny all others.
Show answer and explanation
Correct answer: A
Explanation
To effectively limit permissions to only the necessary VM management tasks within a resource group, you should create and assign a custom role that includes the required actions. This follows the principle of least privilege while avoiding broader access or unnecessary permissions.
- A. Correct.
Creating a custom role with only the necessary VM management actions and assigning it at the resource group scope gives developers the minimal permissions needed.
- B. Incorrect.
Assigning the Virtual Machine Contributor role at the subscription scope grants privileges across the entire subscription, which is more than needed.
- C. Incorrect.
The Owner role at any scope grants full administrative control, violating the principle of least privilege.
- D. Incorrect.
Azure Policy is used to enforce organizational standards and compliance, not to provide granular permissions in the same way RBAC does.