In Microsoft Azure, Role-Based Access Control (RBAC) allows you to manage access to Azure resources by assigning roles to users, groups, and service principals. The Logic App Contributor role specifically grants the ability to create, edit, and manage Logic Apps but not assign permissions or modify access control (IAM).

According to the official Microsoft Azure documentation for built-in roles in Azure RBAC:

“The Logic App Contributor role lets you manage logic apps, but not access them. You can view, edit, update, and delete logic apps.”

In the given scenario, the Developers group needs the ability to create Azure Logic Apps within the Dev resource group. Assigning the Logic App Contributor role at the resource group level provides exactly that scope of control—users in the group can manage Logic App resources within that resource group without affecting other resources or permissions at the subscription level.

This satisfies the requirement under the principle of least privilege, as the Developers group gets only the permissions necessary to create and manage Logic Apps within Dev, and no more.

This is verified in the Microsoft Learn AZ-104 study guide under the topic “Manage Azure Role-Based Access Control (RBAC)”, which emphasizes assigning the minimal level of role permissions required to complete administrative tasks at the appropriate scope (subscription, resource group, or resource).

Therefore, the proposed solution meets the goal because the Logic App Contributor role grants precisely the permissions needed.