Start VM on Connect is enabled on a pool whose host-pool managed identity will execute the feature. All target VMs are in one dedicated resource group. Security requires the least-privilege suitable built-in role and a scope containing only that group. Which assignment meets the requirement?

✓ Correct answer

• Desktop Virtualization Power On Contributor on the target resource group.

Start VM on Connect supports a host-pool managed identity and a lower scope that contains the target VMs. Power On Contributor supplies the needed role without the extra stop privileges of Power On Off Contributor. Option explanations: A. Desktop Virtualization Power On Contributor on the host-pool resource alone.: The host-pool resource is not a containing Azure scope for the VM resources, so that assignment does not cover them. B. Desktop Virtualization Power On Off Contributor on the target resource group.: The extra stop/deallocate permissions are unnecessary for this least-privilege Start VM on Connect assignment. C. Desktop Virtualization Power On Contributor on the target resource group.: The selected role is suitable for Start VM on Connect, and the resource group contains all target VMs. D. Desktop Virtualization Power On Contributor on the subscription.: Subscription scope can work, but it exceeds the stated resource-group scope requirement. Sources: Configure Start VM on Connect — https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect; Assign Azure roles to AVD service principals and managed identities — https://learn.microsoft.com/en-us/azure/virtual-desktop/service-principal-assign-roles; Built-in Azure RBAC roles for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rbac

Read the source reference