Limit production support to safe VM operations
Try this labAll AZ-104 practice
- Certification
- AZ-104
- Format
- Structured configuration
- Difficulty
- medium
- Estimated time
- 15 min
- Automated checks
- 9
SCENARIO
Production support needs to inspect, start, and restart VMs in rg-app-prod. The inherited custom role is assignable across the subscription and grants broad Compute, Network, and Blob access. Its assignment must be restricted to /subscriptions/11111111-2222-3333-4444-555555555555/resourceGroups/rg-app-prod.
TASK
Repair vm-operator-role.json so effective access permits only VM property and instance-view reads, start, and restart within the supplied resource group.
- Grant no data-plane access, wildcard permissions, or unrelated operations.
- Preserve the role name, description, and custom-role marker.