You have an azure subscription that contains a resource group named RG1, RG1 contains two...

In Microsoft Entra ID–based sign-in to Azure VMs, the right to sign in is granted by the Azure RBAC data-plane roles Virtual Machine User Login and Virtual Machine Administrator Login . The SC-300 study materials state that these roles are “used to log in to a virtual machine with Azure AD credentials” and that scope inheritance applies: “RBAC permissions assigned at a higher scope (subscription, resource group) flow down to child resources.” The guidance further clarifies the difference: “Virtual Machine User Login allows standard user login” while “Virtual Machine Administrator Login allows administrator login.” By contrast, management roles such as Virtual Machine Contributor “manage virtual machines but do not grant sign-in rights.”

Applying this to the scenario: User1 has Virtual Machine User Login at the subscription scope , therefore the permission is inherited by RG1 , VM1 , and VM2 , allowing User1 to sign in to both VMs. User3 holds Virtual Machine Administrator Login scoped to VM1 , which authorizes sign-in only to VM1 (administrator level) and does not apply to VM2. User2 has Virtual Machine Contributor at RG1 ; this provides management capabilities (start/stop, configure) but no sign-in permission, so User2 cannot sign in to either VM.

Therefore, the correct selections are VM1: User1 and User3 only and VM2: User1 only .