Microsoft Azure Administrator Associate AZ-104 Practice Question

Creating a custom Azure RBAC role with the required permissions and assigning it to the developers at the resource group scope is the correct solution. This approach allows you to include specific actions like starting, stopping, and restarting virtual machines while excluding delete permissions and role assignments. Assigning it at the resource group scope ensures the permissions are limited to that resource group.

Assigning the 'Contributor' role would grant excessive permissions, including the ability to delete resources. Creating an Azure AD role is inappropriate because Azure AD roles manage permissions to Azure Active Directory resources, not Azure resources like virtual machines. Assigning the 'Virtual Machine Operator' built-in role at the subscription level is too broad in scope and may not precisely meet the permission requirements.