A municipal-records clerk needs to reset passwords and restart a si…

Question

A municipal-records clerk needs to reset passwords and restart a single VM. A teammate tries to add microsoft.directory password actions to an Azure custom role JSON. What should the security engineer do instead?

Accepted Answer

Assign a Microsoft Entra custom role for password reset and a separate Azure role for the VM restart — Two locksmiths, two key rings: Entra custom roles talk Graph/directory, Azure custom roles talk Resource Manager. Password reset lives on the Entra ring; VM restart lives on the Azure ring—stuffing directory verbs into Azure JSON will not open either door cleanly.

Answer

Keep both permission types in the Azure custom role and assign it at the VM resource scope

Answer

Convert the Azure custom role into a management-group assignment so directory actions activate

Answer

Use only a Microsoft Entra custom role because Entra roles already include Azure VM restart

A municipal-records clerk needs to reset passwords and restart a single VM. A teammate tries to add microsoft.directory password actions to an Azure custom role JSON. What should the security engineer do instead?

Short Explanation

Full Explanation