Question

Your company uses Azure RBAC to control access. A user is assigned the Reader role at the subscription scope and the Contributor role at a resource group named RG-Prod within that subscription. The Contributor role is later removed, and a Deny assignment for delete operations is added at the RG-Prod scope. What are the user's effective permissions on a virtual machine inside RG-Prod?

Accepted Answer

The user can read the VM but cannot modify or delete it.

Answer

The user can read and modify the VM but cannot delete it.

Answer

The user has no access to the VM because the Deny assignment overrides all roles.

Answer

The user can read, modify, and delete the VM because Reader is inherited from the subscription.