AZ-500 Question 8
Single answerYou are an Azure security engineer for a company that needs to create a custom Azure role granting a development team the ability to start and stop virtual machines in a specific resource group. The development team’s Microsoft Entra ID security group must be assigned this role, and the team should not be able to delete any virtual machines. Which is the best way to achieve this requirement?
- A
Create a custom Azure role granting 'Microsoft.Compute/*' privileges at the subscription scope and exclude 'virtualMachines/delete', then assign it to the group using the subscription Role Assignments.
- B
Create a custom Azure role listing only the required VM actions and excluding 'Microsoft.Compute/virtualMachines/delete' at the resource group scope, then assign it to the Entra security group at that resource group scope.
- C
Use the built-in Virtual Machine Contributor role directly at the resource group scope and rely on service-level security to block VM deletions.
- D
Create a custom Microsoft Entra role in the Microsoft Entra admin center with only the start and stop actions, then assign that role to the group at the directory level.
Show answer and explanation
Correct answer: B
Explanation
To manage resource-level permissions effectively, you should create a custom Azure role (rather than a Microsoft Entra directory role) that includes only the necessary actions within the scope of the target resource. In this scenario, granting start/stop privileges and excluding 'virtualMachines/delete' ensures compliance with least-privilege principles. Assigning that custom role to the Microsoft Entra ID security group at the resource group scope is a recommended approach. For more details, refer to Microsoft’s documentation on custom roles and role assignments in Azure RBAC: https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles.
- A. Incorrect.
Option 1 is incorrect. Assigning the custom role at the subscription scope would grant the group unnecessary permissions across the entire subscription, violating the principle of least privilege. Excluding 'virtualMachines/delete' actions is correct, but the scope is too broad.
- B. Correct.
Option 2 is correct. Defining a custom Azure role that includes only the required start and stop actions, excluding deletions, and assigning it at the resource group scope is a best practice. This ensures that permissions are limited to the intended resource group, aligning with the principle of least privilege. Additionally, assigning it to the Microsoft Entra group at the resource group scope streamlines ongoing management.
- C. Incorrect.
Option 3 is incorrect. While the built-in Virtual Machine Contributor role closely matches some required permissions, it still permits VM deletions. Relying on service-level security to block deletions can be cumbersome and is not the recommended approach when a custom role can precisely define allowed and denied actions.
- D. Incorrect.
Option 4 is incorrect. Microsoft Entra roles govern directory-level tasks (for example, user administration, conditional access), but Azure roles govern access to Azure resources. A custom role for Azure resources must be created and assigned through Azure RBAC, not as a Microsoft Entra role at the directory level.