A canal-authority night shift must restart only the virtual machine…

Question

A canal-authority night shift must restart only the virtual machine that opens Lock 7, but last week an operator received rights on the entire subscription. Which Azure RBAC assignment scope still lets that operator restart the VM while following least privilege?

Accepted Answer

Assign Virtual Machine Contributor on the Lock 7 virtual machine resource itself — Think of the canal as nested boxes: management group, subscription, resource group, then the single lock VM. Hand the night shift the key to that one VM box—Virtual Machine Contributor on the Lock 7 resource—so they can restart it without opening every other lock on the waterway.

Answer

Assign Virtual Machine Contributor at the subscription that holds every canal resource

Answer

Assign Owner at the management group that contains the canal subscriptions

Answer

Assign Contributor at the resource group and rely on Azure Policy to block other VMs

A canal-authority night shift must restart only the virtual machine that opens Lock 7, but last week an operator received rights on the entire subscription. Which Azure RBAC assignment scope still lets that operator restart the VM while following least privilege?

Short Explanation

Full Explanation