Question

Your company needs a custom Azure role for a team of support engineers. They must be able to view and restart virtual machines in a resource group, but they must NOT be able to delete virtual machines or change any role assignments. You are defining the JSON for the custom role. Which combination of properties correctly enforces these requirements?

Accepted Answer

Set "Actions" to "Microsoft.Compute/virtualMachines/read" and "Microsoft.Compute/virtualMachines/restart/action", and leave "NotActions" empty.

Answer

Set "Actions" to "Microsoft.Compute/*" and set "NotActions" to "Microsoft.Compute/virtualMachines/delete" and "Microsoft.Authorization/*/write".

Answer

Set "Actions" to "*" and set "NotActions" to "Microsoft.Compute/virtualMachines/delete".

Answer

Set "DataActions" to "Microsoft.Compute/virtualMachines/read" and "Microsoft.Compute/virtualMachines/restart/action", and set "NotDataActions" to "Microsoft.Compute/virtualMachines/delete".