Exam AZ-500 topic 2 question 41 discussion

I think answer is correct, YES NO NO. Azure custom roles: https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles Available permissions (e.g. “Microsoft.Compute/*”): https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations User1 can create new virtual machine in RG1: YES (Permission needed is: Microsoft.Compute/virtualMachines/write, Creates a new virtual machine or updates an existing virtual machine) User1 can modify the properties of storage1: NO (Microsoft.Storage/storageAccounts/write, Creates a storage account with the specified parameters or update the properties or tags or adds custom domain for the specified storage account.) User1 can attach the network interface of VM1 to VNET1: NO (I’m not sure of the exact resource provider operation here, but from the docs it looks like it’s not possible from Microsoft.Compute/*, so I’m pretty sure answer is NO. The relevant operation should be in Microsoft.Network/virtualNetworks/*, I guess.)

NO NO NO Just tested and VM creation fails because you need further permissions to join a subnet. My JSON: { "id": "/subscriptions/16ea6f64-d8b2-4fb4-a7c4-4e6aaad4d751/providers/Microsoft.Authorization/roleDefinitions/f40893f6-07cc-476d-9b74-75fbf3499s47", "properties": { "roleName": "rbac1", "description": "", "assignableScopes": [ "/subscriptions/16ea6f64-d8b2-4fb4-a7c4-4e6aaad4d751", "/subscriptions/16ea6f64-d8b2-4fb4-a7c4-4e6aaad4d751/resourceGroups/rbac1" ], "permissions": [ { "actions": [ "Microsoft.Compute/*" ], "notActions": [], "dataActions": [], "notDataActions": [] } ] } }

NNN. Everyone who says that Microsoft.Compute/* is enough to create VM please check Virtual Machine Contributor Role that actually has the right permissions to create VMs

false answer: no no no Minimum Permissions: If you are assigning custom roles or minimum necessary permissions, ensure that the user has at least the following permissions on the resource group: Microsoft.Compute/virtualMachines/*/write Microsoft.Network/networkInterfaces/*/write Microsoft.Storage/storageAccounts/*/read

Microsoft.Compute/* Grants access to all actions for all resource types in the Microsoft.Compute resource provider

No, No , No - Adding the compute/* role to the resource group will grant that permission to new resources but will not modify permissions on existing resources. You will not be able to attach the virtual machine to the existing virtual network so the VM creation will fail.

Action string Description */read Grants access to read actions for all resource types of all Azure resource providers. Microsoft.Compute/* Grants access to all actions for all resource types in the Microsoft.Compute resource provider. Microsoft.Network/*/read Grants access to read actions for all resource types in the Microsoft.Network resource provider. Microsoft.Compute/virtualMachines/* Grants access to all actions of virtual machines and its child resource types. microsoft.web/sites/restart/Action Grants access to restart a web app.

NNN is the answer. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor

No , No , No Minimum requirements: "Microsoft.Compute/*/read", "Microsoft.Compute/virtualMachines/write", "Microsoft.Network/*/read", "Microsoft.Storage/*/read", "Microsoft.Authorization/*/read", "Microsoft.Resources/*/read", "Microsoft.Compute/virtualMachines/extensions/write"

YES NO NO

Microsoft.Compute/* includes everything under it, including Microsoft.Compute/virtualMachines/write, which says “ Creates a new virtual machine or updates an existing virtual machine”. So the first one is YES YES NO NO

Just testd on LAB NO NO NO

YES-NO-NO is correct. Microsoft.Compute/virtualMachines/write Creates a new virtual machine or updates an existing virtual machine https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftresources:~:text=Microsoft.Compute/virtualMachines/write

NO NO NO

Correct Answer -- Yes, No, No

Answer is correct YNN If existing vents we can create virtual machine https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor

correct answer