An operator must be able to start, stop and reconfigure virtual machines in one resource group, and must have no rights anywhere else in the subscription. Which mechanism should be used?
Show answer and explanation
Answer: B
Azure RBAC is the authorisation system for control-plane operations. Assigning a role such as Virtual Machine Contributor to the operator at the resource group scope gives exactly the actions that role contains, and inheritance carries those permissions to the virtual machines inside the group. Nothing is granted at the subscription or at sibling resource groups. For tighter control, a custom role can list only the start, restart, deallocate and read actions, and the assignment can even be narrowed to one virtual machine.
Why the other options are wrong
- A. Azure Policy evaluates resource configuration against rules and reports or blocks non-compliance. It never grants an identity the ability to perform an operation.
- C. A resource lock prevents deletion or modification of a resource. It is a protection mechanism and does not give the operator any permission.
- D. A management group sits above subscriptions and broadens the scope. Creating one would not restrict the operator to a single resource group.
Exam tip. Permissions come from RBAC; policy only constrains what permitted actions may produce.