Question

A company operates a large Azure environment with a management group hierarchy and multiple subscriptions. The operations team needs to allow a group of junior support engineers to restart virtual machines and view their properties across a specific subscription, but they must not be able to create, delete, or resize VMs, nor change networking. The built-in Virtual Machine Contributor role grants too many permissions. What should you recommend to grant these permissions following the principle of least privilege?

Accepted Answer

Create a custom RBAC role with only the required Actions (such as Microsoft.Compute/virtualMachines/restart/action and read actions) and assign it at the subscription scope.

Answer

Assign the built-in Reader role plus the Virtual Machine Contributor role at the subscription scope.

Answer

Create an Azure Policy definition that denies VM create, delete, and resize operations and assign Contributor to the engineers.

Answer

Assign the built-in Contributor role scoped to a resource group and rely on Azure Policy to block networking changes.