Minimum Azure RBAC Role Assignments for User1
Answer
Correct answer: C — Three role assignments are required: Reader at Subscription, Virtual Machine Contributor at RG1, and Storage Account Contributor at RG1.
You have an Azure subscription that contains a user named User1 and two resource groups named RG1 and RG2. You need to ensure that User1 can perform the following tasks: • View all resources. • Restart virtual machines. • Create virtual machines in RG1 only. • Create storage accounts in RG1 only. What is the minimum number of role-based access control (RBAC) role assignments required?
azure rbac minimum assignments
virtual machine contributor role
storage account contributor role
azure reader role scope
Community Votes
64% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests understanding that 'Reader', 'Virtual Machine Contributor', and 'Storage Account Contributor' are separate built-in roles that cannot be combined into a single assignment without violating least privilege or requiring custom roles not implied by 'minimum assignments'.
Determines the minimum number of RBAC role assignments needed to grant specific view, restart, and creation permissions in Azure. The correct answer is C because distinct built-in roles are required to satisfy least privilege across subscription and resource group scopes.
Selecting B (2) by assuming a single Custom Role or a broader Built-in Role like 'Contributor' can cover all tasks at RG1 scope while maintaining subscription-level read access, often overlooking that Reader is a separate role assignment at the subscription level.
Community Discussion (18 comments)
penatuna
👍 9
Selected: B
You need two role assignments, one for RG1 and other for RG2. If you make just one assignment for both of the Resource groups, User1 will have Virtual machine & Storage account creating rights in both resource groups. If you put the scope on Subscription or Management group that has these Resource groups, the resource groups will inherit the role assignment from higher level (parent) resource. You can make a custom role for RG1 with permissions shown below: /read - View all resources Microsoft.Compute/virtualMachines/restart/action - Restart virtual machines. Microsoft.Compute/virtualMachines/write - Creates a new virtual machine or updates an existing virtual machine. Microsoft.Storage/storageAccounts/write - Creates a storage account with the specified parameters or update the properties or tags or adds custom domain for the specified storage account. For RG2 you should make custom role with these permissions: /read - View all resources Microsoft.Compute/virtualMachines/restart/action - Restart virtual machines.
[Removed]
👍 5
Selected: C
A. 1: Assigning a single role likely wouldn't provide all the required permissions. B. 2: It might be possible with two roles, but achieving granular control for resource group specific actions requires more than one. C. 3: This is the most likely scenario. We need separate role assignments for broader and specific resource group permissions. D. 4: While possible, 3 roles should be sufficient to achieve the desired outcome. Here's a breakdown of the minimum required RBAC role assignments: Reader role: This grants User1 the ability to view all resources across the subscription, fulfilling the first requirement. Contributor role for RG1: This grants User1 permission to create virtual machines and storage accounts within resource group RG1, addressing the needs for resource creation in a specific group. Virtual Machine Contributor role: This grants User1 the ability to restart virtual machines across the subscription, fulfilling the third requirement.
nik_si
👍 1
Selected: C
Reader Role at the subscription level: Allows User1 to view all resources. Virtual Machine Contributor Role at the subscription level: Allows User1 to restart virtual machines in any resource group. Custom Role at the RG1 level: Includes permissions to create virtual machines and storage accounts in RG1.
ElWhitepages
👍 1
Selected: C
Reader at the subscription level Lets User1 see all resources (every RG, every resource type). Virtual Machine Operator at the subscription level Lets User1 start, stop, and restart VMs anywhere in the subscription—but not create or delete them. Contributor on RG1 Lets User1 create (and manage) any resource in RG1 (including VMs, storage accounts, etc.) Does not give them creation rights in RG2 or other resource groups.
bardock100
👍 2
Selected: C
To meet the requirements for User1, you will need to assign three RBAC roles: Reader role at the subscription level to allow User1 to view all resources. Virtual Machine Contributor role at the subscription level to allow User1 to restart virtual machines. Contributor role at the RG1 level to allow User1 to create virtual machines and storage accounts in RG1 only. Therefore, the minimum number of RBAC role assignments required is C. 3
YesPlease
👍 1
Selected: B
Answer B) 2 You can create just one custom role to create VM, restart them and the create storage account....and apply it to only RG1. Assign READER role at top level to view all resources outside of RG1.
_marc
👍 1
Selected: B
Can be done with 2 custom role assignments. The question doesn't explicitly state that only in-built roles can be used.
JohnnyChimpo
👍 2
Selected: C
This is a retarded question. It can be either 3 or 4
khangkowng1
👍 4
Selected: C
Minimum Number of Role Assignments: To meet these requirements, User1 needs a combination of Reader, Virtual Machine Contributor, and Storage Account Contributor roles. Since there is overlap in the roles that allow User1 to restart VMs and create VMs, we can optimize the number of role assignments. Reader role at the subscription level. Virtual Machine Contributor role at RG1 (to allow both VM creation and VM restart in RG1). Storage Account Contributor role at RG1. Conclusion: The minimum number of role assignments required is 3. Thus, the correct answer is: C. 3
emartiy
👍 4
Selected: B
2 RBAC roles are sufficient to perform what in case.
mb0812
👍 5
Selected: C
Answer has to be C View all resources: READER role Restart virtual machines (it means RG1 and RG2 machines): VM contributor role Create VM/Storage accounts in RG1: Contributor role for RG1
Ragdoll
👍 3
Selected: B
2 roles are sufficient: - Reader on the subscription level. It fulfills the 1st requirement. - Contributor or Owner on RG1, which fulfills the 2nd requirement - There is nothing to do with RG2 because it's empty (I assume). So, no role should be assigned.
Sozo
👍 4
Selected: C
To enable User1 to perform the specified tasks in Azure, you would need at least three role-based access control (RBAC) role assignments: Reader Role: This role allows User1 to view all resources in both resource groups, RG1 and RG2. Virtual Machine Contributor Role: This role permits User1 to restart virtual machines. It should be assigned at the scope of both RG1 and RG2 to cover all virtual machines. Contributor Role for RG1: This role allows User1 to create virtual machines and storage accounts, but it should be assigned specifically to RG1 only. Therefore, the minimum number of RBAC role assignments required is 3, making option C the correct answer.
Doinitza
👍 4
It's 2 (B), by adding custom role/s.
loaysalameh
👍 5
Selected: C
3 roles Assign User1 the "Reader" role at the subscription level to view all resources. Assign User1 the "Virtual Machine Contributor" role at the RG1 level to restart virtual machines and create virtual machines in RG1 only. Assign User1 the "Storage Account Contributor" role at the RG1 level to create storage accounts in RG1 only.
SFAY
👍 3
Selected: C
If least privilege is not a concern then you just need one role - Contributor for both R1 and R2 However, I believe we will always want least privileges and in that case you will need three RBAC roles: Reader - to view all resources in r1 and r2 as there are other resources besides VMs and SAs in the RGs. VM Contributor - To create & restart VMs Storage Account Contributor - To create storage accounts
dbz_34
👍 1
Selected: A
technically 1 role is possible since the question doesn't require the use of the least privileges the role of contributor could suffice?
throwaway10188
👍 2
You can TECHNICALLY provide all of it is requested with 2 roles (which the question is asking for) but if you wanted to be as strict as possible 4 roles would be the best IMO.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
To achieve the specified requirements with minimal assignments using standard built-in roles, three distinct assignments are necessary. First, assign the Reader role at the Subscription scope to allow User1 to view all resources across RG1 and RG2. Second, assign the Virtual Machine Contributor role at the RG1 scope; this grants permission to create VMs and also includes the ability to restart them (as restarting is part of the VM management operations covered by this role). Third, assign the Storage Account Contributor role at the RG1 scope to enable creating storage accounts. This totals 3 assignments.Why the Other Options Are Wrong
Option A (1) is incorrect because a single role like 'Contributor' at RG1 would not grant read access to RG2 or the subscription root, and 'Owner' would grant excessive permissions. Option B (2) might seem plausible if one assumes a custom role or misinterprets scope inheritance, but you cannot combine 'Reader' (subscription scope) with RG-specific write permissions into two standard built-in role assignments without either over-granting or under-granting. Option D (4) is unnecessary as three well-placed built-in roles fully satisfy the constraints.Community Comment Notes
Many learners initially voted for B, arguing that a Custom Role could combine permissions, but the question implies standard RBAC usage where 'minimum assignments' usually refers to built-in roles unless specified otherwise. Comments highlighting the separation of 'Reader' at the subscription level and distinct contributor roles at the RG1 level support the answer C. Some users noted that 'Virtual Machine Contributor' covers both creating and restarting VMs, reducing the need for a separate 'Restart' role assignment.Exam Strategy
Always check if a single built-in role covers multiple actions (e.g., VM Contributor covers restart and create). Separate scope-based needs (Subscription Read vs. RG Write) require distinct assignments even if the user is the same.
Frequently Asked Questions
Does Virtual Machine Contributor include restart permissions?
Yes, Virtual Machine Contributor includes permissions to start, stop, and restart virtual machines along with create/delete operations.
Why can't we use one Contributor role for everything?
A Contributor role at RG1 scope does not grant read access to RG2 or the subscription level. Reader is a separate role needed for broad visibility.
Related Analysis
Practice All SC-300 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-300 Practice Test →