A municipal-records clerk needs to reset passwords and restart a single VM. A teammate tries to add microsoft.directory password actions to an Azure custom role JSON. What should the security engineer do instead?
Select an answer to reveal the explanation.
Short Explanation
Two locksmiths, two key rings: Entra custom roles talk Graph/directory, Azure custom roles talk Resource Manager. Password reset lives on the Entra ring; VM restart lives on the Azure ring—stuffing directory verbs into Azure JSON will not open either door cleanly.
Full Explanation
Microsoft Entra RBAC and Azure RBAC are separate permission systems. Directory actions such as password reset live in Microsoft Entra roles, while restarting a virtual machine is an Azure Resource Manager action granted through Azure RBAC. For the municipal-records clerk who must reset passwords and restart a single VM, the security engineer should assign a Microsoft Entra custom (or built-in) role that covers password reset and a separate Azure role scoped to that VM for restart—not merge directory actions into an Azure custom role JSON.
Keeping both permission types in one Azure custom role fails by concept: Azure role definitions authorize Microsoft.Authorization / resource-provider Actions and DataActions; microsoft.directory-style directory permissions are not activated by stuffing them into an Azure role and assigning it at VM scope. Converting the Azure custom role into a management-group assignment fails because widening Azure assignable scope still does not turn Entra directory permissions on. Using only a Microsoft Entra custom role fails because Entra roles do not include Azure VM restart rights; the clerk would reset passwords but still lack compute restart on the municipal VM.
Exam caveat: AZ-500 repeatedly tests that Entra directory roles and Azure resource roles are not interchangeable, even when one person needs both capabilities. Operational check: grant the Entra password-reset role, grant Azure VM restart (for example Virtual Machine Contributor or a trimmed custom role) on the single VM, then verify password reset works in Entra and restart works on that VM only.