AZ-104 Question 22
Single answerYou need to grant a junior admin the ability to create, start, and stop virtual machines within a resource group, but you do not want them to manage network resources or apply resource locks. Which built-in Azure role best meets this requirement?
- A
Owner
- B
Virtual Machine Contributor
- C
Reader
- D
Network Contributor
Show answer and explanation
Correct answer: B
Explanation
By selecting the Virtual Machine Contributor role, the junior admin can manage virtual machines without being able to alter network resources or apply locks, aligning perfectly with the stated requirements.
- A. Incorrect.
Owner provides full control over all resources and can delegate access, which is more permissive than required.
- B. Correct.
Virtual Machine Contributor allows creation, management, and operational tasks for VMs without granting access to modify network resources.
- C. Incorrect.
Reader only permits viewing resources and does not allow the user to create or manage them.
- D. Incorrect.
Network Contributor provides the capability to manage network resources, which exceeds the requirement for managing only virtual machines.