Microsoft Azure Administrator Associate AZ-104 Practice Question

Creating a custom role by copying an existing role that manages virtual machines and removing the networking permissions ensures the users have exactly the permissions they need. Azure allows administrators to create custom roles based on built-in roles and tailor the permissions as required. Assigning the 'Contributor' role and blocking permissions using Azure Policy is more complex and less precise. Built-in roles cannot be edited in Azure; they can only be used as is or copied to create custom roles. Assigning multiple built-in roles may grant more permissions than necessary or not restrict network access appropriately.