
Explanation
User 1 can sign in to VMI. = YES
Explanation: User 1 has the Virtual Machine User Login role assigned at the scope of RG1. This role allows the user to sign in to virtual machines in the resource group using Azure AD credentials. VMI is a virtual machine in RG1, so User 1 can sign in to it.
User 2 can manage disks and disk snapshots of VMI. = NO
Explanation: User 2 has the Disk Snapshot Contributor role assigned at the scope of MG2. This role allows the user to manage disk snapshots in the management group. However, VMI is not in MG2, but in RG1, which is in MG1. Therefore, User 2 does not have the permission to manage disks and disk snapshots of VMI.
User 2 can manage disks and disk snapshots of VM3. = YES
Explanation: User 2 has the Disk Snapshot Contributor role assigned at the scope of MG2. This role allows the user to manage disk snapshots in the management group. VM3 is a virtual machine in RG3, which is in Sub2, which is in MG2. Therefore, User 2 has the permission to manage disks and disk snapshots of VM3.
Recent Comments (The most recent comments are at the top.)
I think the answers should be: N N N
1. User1 can sign in to VM1
No
User1 is assigned as Virtual Machine Contributor in MG1.
And Virtual Machine Contributor can't log in to VM as a regular user.
2. User2 can manage disks and disk snapshots of VM1
No
Since User2 only has Virtual Machine User in Sub1, so he can log in to VM1 but can't manage disks or snapshots
3. User2 can manage disks and disk snapshots of VM3
No
Virtual Machine Contributor only has permission to manage disks, but not disk snapshots (Disk Snapshot Contributor permission)