Better Scope the access needed to restore a VM from recovery vault
While our 3rd party MSP was attempting to restore a VM we found that they did not have the required permissions. After reviewing the docs here https://docs.microsoft.com/en-us/azure/backup/backup-rbac-rs-vault
we found that they need Contributor access, specifically resourcegroups/write.
Creating resources groups is an authorization we need to limit. Requesting the product group remove this authorization from VM restores.