Scenario 1

• Create a RBAC for the developers group to have Reader Access on Azure and Contributor access for VirtualMachines
• Solution: Refer Here
• Create a custom role
• Ensure Developer have no role assignments and then add a role assignment to the developers group
• After the Role Assignment is successful, try to login as developer and check the access

Scenario 2:

• Create a Role for QA Engineers where they have Reader access on Azure and they should have Storage Account Contributor access at Subscription level.
• Refer Here for the solution

Scenario 3:

• Create a Role for Developers (Delete all existing role assignments). Ensure this developers group has a contributor access on everything and no access to virtual machines
• Refer Here for the solution

Security Defaults

• Security defaults are set of built-in policies that protect your organization from common threats
  • It requires all the users to register for MFA
  • It requires users to USE MFA when necessary
  • It requires administrators to perform MFA
  • It protects privileged activities such as accessing the Azure portal