Question
You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named contoso.com. Contoso.com contains the users shown in the following table.
You deploy a virtual machine that has the following configurations:
• Name: VM1
• Resource group: RG1
• Operating system: Windows Server
• Login with Microsoft Entra ID: Enabled
You have the Azure role assignments shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
| Name | Type |
| --- | --- |
| User1 | Member |
| User2 | Guest |
| User3 | Member |
| User | Role | Scope |
| --- | --- | --- |
| User1 | Virtual Machine Contributor | RG1 |
| User2 | Virtual Machine User Login | RG1 |
| User3 | Virtual Machine Administrator Login | Sub1 |
Explanation
Statement 1 (No): Signing in to a Windows VM with Microsoft Entra credentials requires the Virtual Machine Administrator Login or Virtual Machine User Login role. User1 has Virtual Machine Contributor, a management-plane role that lets User1 manage VM1 but does not grant sign-in rights.
Statement 2 (No): User2 has Virtual Machine User Login at RG1, which would normally allow sign-in, but User2 is a guest (B2B) account. Microsoft Entra sign-in to Windows VMs supports only standard user accounts from the same tenant as the VM; guest accounts cannot be used for authentication.
Statement 3 (Yes): User3 is a member account with Virtual Machine Administrator Login assigned at the Sub1 scope. Azure role assignments are inherited by child scopes, so the assignment applies to RG1 and VM1, and User3 can sign in with administrator privileges.
