What's the best way to grant a team permission to only start and stop VMs in a specific resource group?

Creating a Custom RBAC role with specific actions for starting and stopping VMs in a particular resource group is the most precise and secure method. This adheres to the principle of least privilege, granting only the necessary permissions. Assigning the Contributor role at the subscription level would give the team far too many permissions across all resources in the subscription, violating least privilege. Applying a ReadOnly lock on the VM would prevent any modifications, including starting or stopping, which is the opposite of the requirement. Granting the Owner role on the resource group would give full control over all resources within that group, exceeding the requested permissions.