A botanical-garden ticketing crew only needs to start and restart VMs in one resource group after an intern with Contributor deleted a public IP. Which assignment best restores least privilege for that crew?

Job-function built-in roles such as Virtual Machine Contributor grant the actions needed to manage VMs (including start and restart) without the broad resource-creation and networking powers of Contributor or Owner. After an intern with Contributor deleted a public IP, the botanical-garden ticketing crew should be restored to least privilege by assigning Virtual Machine Contributor on the resource group so they can power-cycle VMs without again holding keys to every networking and ancillary resource in that group.

Assigning Owner on the resource group fails least privilege: Owner can restore deleted networking but also assign roles and change nearly everything, far beyond start/restart. Assigning Contributor on each virtual machine fails because Contributor on the VM still allows extensive changes to that resource and does not address the lesson from the deleted public IP—Contributor is broader than the job—and relying on activity logs only detects damage after the fact. Assigning Reader plus Azure Bastion fails by concept: Reader cannot change power state, and Bastion is a connectivity broker for RDP/SSH, not an authorization grant that enables start/restart through RBAC.

Exam caveat: prefer job-function roles (Virtual Machine Contributor, Storage Blob Data Reader, and so on) over Owner/Contributor when the task is narrow. Operational check: assign Virtual Machine Contributor at the resource group, confirm operators can start/restart VMs, attempt to delete a public IP or NIC as that principal, and verify the action is denied.