A canal-survey team may restart VMs and read metrics but must not create disks or change NICs, and every nearby built-in compute role still includes extra write actions. What should the security engineer do?
Select an answer to reveal the explanation.
Short Explanation
When the factory-made wrench still turns bolts you do not want touched, copy the closest built-in Azure role and file off the extra Actions. That custom Azure role stays in Resource Manager—do not stuff compute verbs into an Entra directory role.
Full Explanation
Custom Azure roles are appropriate when built-in roles are overly broad for least privilege. Engineers typically clone a similar built-in role and remove excess Actions. Microsoft Entra custom roles address directory permissions, not Azure Resource Manager compute operations; locks and Blueprints do not replace precise RBAC.