You have an Azure resource group named RG1 that contains two virtual machines named VM1 and VM2

You have an Azure resource group named RG1 that contains two virtual machines named VM1 and VM2.

A user named User1 is assigned the Virtual Machine Contributor role on RG1.

You need to deny User1 the Virtual Machine Contributor role on VM1.

What should you use?

a) a lock

b) an Azure policy

c)an Azure Blueprint

d) a virtual machine extension