AZ-500 Question 6
Single answerYour company has a resource group named RG1 that contains multiple Azure resources, including virtual machines, Azure SQL databases, and storage accounts. A new junior engineer needs to create, start, stop, and manage virtual machines but should not be able to modify or delete other types of resources in RG1. Which built-in role assignment should you configure to meet these requirements?
- A
Assign the Contributor role at the subscription scope
- B
Assign the Virtual Machine Contributor role at the RG1 scope
- C
Assign the Virtual Machine Operator role at the RG1 scope
- D
Assign the Owner role at the subscription scope
Show answer and explanation
Correct answer: B
Explanation
Azure provides built-in roles for role-based access control (RBAC) to granularly manage resources. 'Virtual Machine Contributor' is designed to grant permissions solely for creating and managing VMs and is best assigned at the smallest appropriate scope, in this case, RG1, to limit exposure. For more information, see Azure RBAC built-in roles in the Microsoft documentation: https://learn.microsoft.com/azure/role-based-access-control/built-in-roles.
- A. Incorrect.
Incorrect. The Contributor role at the subscription scope grants too many permissions across all resources in the subscription, not just virtual machines, and exceeds the principle of least privilege.
- B. Correct.
Correct. The Virtual Machine Contributor role at the RG1 scope allows the user to create, manage, start, stop, and restart virtual machines within RG1 without granting permissions to modify non-VM resources.
- C. Incorrect.
Incorrect. The Virtual Machine Operator role allows actions like starting and stopping VMs but does not allow creating or fully managing them.
- D. Incorrect.
Incorrect. The Owner role at the subscription scope grants full permissions at the highest level, which is far more than required for managing VMs in RG1.