AZ-104 Manage Azure Identities and Governance — 50 Questions

Question 1

A help desk team must be able to reset passwords for cloud users in Microsoft Entra ID, but they must not be able to create or delete users. Which built-in role should you assign?

Accepted Answer

User Administrator. In Microsoft Entra ID, the Helpdesk Administrator role is scoped to reset passwords and manage support requests, but it does not allow creating or deleting users. The User Administrator role, on the other hand, can create and delete users in addition to resetting passwords, which violates the stated restriction. Since Helpdesk Administrator is not an available option, none of the provided choices is correct.

Answer

Global Administrator

Answer

Reader

Answer

Billing Administrator

Question 2

An administrator grants the Helpdesk group the User Administrator role at the tenant scope. The team should be able to reset passwords only for users in the Europe-Users administrative unit. What should the administrator do?

Accepted Answer

Remove the tenant-scope User Administrator assignment, then assign the User Administrator role to Helpdesk for the Europe-Users administrative unit only.. The User Administrator role is already assigned at the tenant scope. To limit password reset ability to only users in the Europe-Users administrative unit, the administrator must first remove the tenant-scope assignment, then assign the User Administrator role scoped to the Europe-Users administrative unit. Without removing the broader assignment, the team retains tenant-wide User Administrator permissions.

Answer

Create a Conditional Access policy that targets Helpdesk and Europe-Users.

Answer

Assign the Password Administrator role at the tenant scope and use Privileged Identity Management.

Answer

Create a custom RBAC role in the subscription and assign it to Helpdesk.

Question 3

You need to prevent accidental deletion of a resource group while still allowing administrators to create and modify resources inside it. Which lock should you apply?

Accepted Answer

CanNotDelete. The CanNotDelete lock prevents the resource group from being deleted while still allowing all operations (including create and modify) on resources within it. This is the correct choice because the requirement is specifically to block deletion, not to restrict modifications or read access.

Answer

ReadOnly

Answer

Delete lock

Answer

No lock and a budget alert

Question 4

You need to let a junior administrator manage virtual machines only in the RG-Dev resource group. The administrator must not be able to change role assignments or manage other resource groups. Which role assignment should you use?

Accepted Answer

Virtual Machine Contributor at the RG-Dev scope. The Virtual Machine Contributor role at the RG-Dev scope grants the junior administrator full permissions to manage virtual machines (including start, stop, restart, delete, and modify VM configurations) but explicitly denies the ability to manage role assignments (RBAC) or access to other resource groups. This aligns with the principle of least privilege, ensuring the administrator can perform their required tasks without exceeding their authority.

Answer

Owner at the RG-Dev scope

Answer

Reader at the subscription scope

Answer

Contributor at the subscription scope

Question 5

A support engineer must start and restart one specific virtual machine from the Azure portal, but must not be able to delete the VM, change networking, or grant access to others. Which two actions should be included in a custom role? Select two.

Accepted Answer

Microsoft.Compute/virtualMachines/start/action grants the ability to start the VM without broader management permissions.. Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/restart/action are specific permissions that allow starting and restarting a VM without granting broader management capabilities like deletion or network changes. These actions are part of Azure RBAC role definitions and can be included in a custom role to limit the support engineer's scope to only these operations.

Answer

Microsoft.Compute/virtualMachines/delete gives the ability to remove the VM from the subscription.

Answer

Microsoft.Network/networkInterfaces/write is needed because a VM start or restart always requires NIC modification rights.

Answer

Microsoft.Authorization/roleAssignments/write would let the engineer grant access to other users and manage permissions.

Question 6

A storage automation service principal must upload, read, and delete blob data in one container by using Microsoft Entra authentication. It must not manage storage account settings, keys, or other containers. Which approach is best?

Accepted Answer

Create a custom role with blob dataActions only and assign it at the container scope.. It creates a custom Azure RBAC role with only the required blob data actions (e.g., Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read, write, delete) and assigns it at the container scope. This ensures the service principal can upload, read, and delete blobs in that specific container using Microsoft Entra authentication, without any permissions to manage storage account settings, keys, or other containers.

Answer

Assign Storage Account Contributor at the resource group scope.

Answer

Assign Reader and give the service principal a storage account access key.

Answer

Assign Contributor at the subscription scope and restrict access with naming conventions.

Question 7

A resource group has a ReadOnly lock applied to it. An operator can view the resources, but several portal changes fail. Which two operations will fail because of the lock? Select two.

Accepted Answer

Changing the size of an existing virtual machine in the resource group will fail because it is a write operation.. A and B are correct because a ReadOnly lock on a resource group prevents all write and delete operations, including resizing a VM (a write) and deleting a storage account (a delete). Read operations such as querying activity logs, listing resources, or fetching VM configurations are not affected.

Answer

Reading the resource group's activity log will fail because lock-protected scopes cannot be queried.

Answer

Listing the resources in the resource group with Azure CLI will fail because enumeration is a write operation.

Answer

Fetching the current VM configuration from the ARM API will fail because reads are denied by the lock.

Question 8

A developer has the Contributor role on a resource group and tries to deploy a Windows VM with a public IP address. The deployment fails, even though the role assignment is active. Which two checks should you perform first to confirm why the deployment failed? Select two.

Accepted Answer

Review Azure Policy assignments at the subscription or management group for deny or modify effects on public IP resources.. Azure Policy can block deployments even when the user has the correct RBAC permissions. A deny policy or a modify policy that cannot be fulfilled can prevent the deployment of public IP resources. Therefore, reviewing Policy assignments at the subscription or management group scope is a key first step. Additionally, even though the developer has an active Contributor role assignment, it is essential to verify that the role is assigned at the scope containing the target resources (the resource group or higher), because the active assignment might be on a different resource group, which would not grant permission for this deployment. RBAC is checked first during authorization, and then policies are evaluated; a policy can still cause failure even if RBAC is satisfied.

Answer

Check for a CanNotDelete lock on the resource group because that lock blocks all deployments.

Answer

Confirm that the VM size is available in the region because size availability is the most common authorization issue.

Answer

Inspect whether tags are inherited from the subscription because tag inheritance can deny a deployment request.

Question 9

Your company wants one governance baseline to apply automatically to all current and future production subscriptions, and finance wants cost reporting by application across many resource groups. Which two design choices best satisfy the requirements? Select two.

Accepted Answer

Place the production subscriptions under a dedicated management group so inherited policy and RBAC can be applied once.. Placing production subscriptions under a dedicated management group allows you to apply Azure Policy and Azure RBAC at the management group scope, which automatically inherits to all current and future subscriptions within that hierarchy, ensuring a consistent governance baseline. To satisfy finance's cost reporting by application, applying consistent tags (e.g., Application or CostCenter) to resources and resource groups enables chargeback and aggregation of costs by application across many resource groups. Both design choices work together: management groups provide governance, tags provide cost attribution.

Answer

Place all production workloads into one shared resource group so governance and reporting are simpler.

Answer

Use management groups instead of tags because tags are not useful for cost reporting.

Answer

Assign the baseline only at one subscription and copy the settings manually to every new subscription.

Question 10

A bootstrap script must install software on three VMs, then download configuration files from Blob Storage. Security forbids secrets in templates or scripts, and the same authentication method must work after the VMs are rebuilt. Which two choices should you make? Select two.

Accepted Answer

Assign a user-assigned managed identity and attach it to each VM.. A user-assigned managed identity provides a secure, credential-free authentication method that persists across VM rebuilds. Unlike system-assigned managed identities, which are tied to a specific VM lifecycle and are lost when the VM is deleted, a user-assigned identity is a standalone Azure resource that can be reassigned to new VMs. This allows the bootstrap script to authenticate to Azure Blob Storage via Azure AD without storing any secrets, satisfying the security constraint. A Custom Script Extension is the appropriate Azure mechanism to run the bootstrap script during provisioning, and it can use the VM's managed identity to download the configuration files from Blob Storage.

Answer

Store the storage account access key in a script variable.

Answer

Create a separate local administrator account for the script to use.

Answer

Embed a SAS token directly in the Bicep parameters file.

Question 11

A shared resource group contains a critical virtual machine and a storage account. Administrators must still be able to update settings, but nobody should accidentally delete either resource during routine maintenance. Which lock should be applied?

Accepted Answer

CanNotDelete lock on the resource group.. The CanNotDelete lock on the resource group prevents deletion of the resource group and all resources within it, while still allowing administrators to update settings. This meets the requirement of protecting both the critical VM and storage account from accidental deletion during routine maintenance, without blocking configuration changes.

Answer

ReadOnly lock on the resource group.

Answer

A policy assignment that denies delete operations.

Answer

A management group assignment with Contributor removed.

Question 12

An operations team needs to let helpdesk staff restart virtual machines and view their properties only in RG-Dev. The staff must not be able to manage virtual networks, disks, or delete any resources. What is the best built-in role assignment?

Accepted Answer

Assign Virtual Machine Contributor at the RG-Dev scope.. The built-in Virtual Machine Contributor role grants full control over virtual machines, including restart, read, write, and delete. It does prevent managing virtual networks and disks, but it does not prevent deletion of VMs. Since the requirement explicitly forbids deleting any resources, this role does not meet the need. No built-in role exactly matches restart + read with no delete; a custom role would be required.

Answer

Assign Reader at the subscription scope so the staff can view the VMs.

Answer

Assign Contributor at the RG-Dev scope.

Answer

Assign Virtual Machine Administrator Login at the RG-Dev scope.

Question 13

A production resource group contains application VMs and databases. Operators must be able to update resources inside the group, but nobody should be able to delete the whole group by accident. Finance also wants ownership data to remain with the resources if they are moved to another resource group. Which two actions should you take? Select two.

Accepted Answer

Apply a CanNotDelete lock to the resource group.. Apply a CanNotDelete lock to the resource group to prevent the entire resource group from being deleted while still allowing resource-level updates within it. Also apply tags such as Department and Owner to the resources to ensure ownership data persists if resources are moved to another resource group, as tags are carried with the resources during a move.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Move the resource group to a management group.

Answer

Grant Resource Policy Contributor to the operators.

Question 14

Finance, HR, and Engineering each have their own subscriptions, and one production resource group must not be deleted by mistake. Which two Azure features should be used? Select two.

Accepted Answer

Create a management group for the subscriptions.. A management group allows you to centrally manage governance across multiple subscriptions. You can use it to apply an Azure Policy that denies deletion of the production resource group, or to assign a custom RBAC role that restricts delete permissions. A CanNotDelete lock on the resource group provides a direct, explicit block that prevents any user or process from deleting it, regardless of their RBAC permissions. Together, these two features ensure the resource group cannot be deleted by mistake.

Answer

Assign Reader to everyone in the company.

Answer

Use a distribution list for the subscriptions.

Answer

Move the resource group into a different region.

Question 15

A company has many subscriptions arranged under a management group named Corp. The audit team needs Reader access to every current and future subscription in Corp, and the administrator wants only one role assignment to maintain. Which two actions should be taken? Select two.

Accepted Answer

Assign Reader at the Corp management group scope.. Assigning the Reader role at the Corp management group scope (Option A) grants read-only access to all current and future subscriptions within that management group due to Azure RBAC inheritance. However, to ensure that this single assignment covers all future subscriptions, those subscriptions must be placed under the Corp management group (Option B). If a new subscription is created outside Corp, it will not inherit the role assignment. Therefore, both actions are required: assign Reader at the Corp scope and ensure all subscriptions remain under Corp.

Answer

Assign Reader separately on each subscription.

Answer

Assign Reader at the tenant root and remove the management group.

Answer

Create a resource group for each subscription and assign Reader there.

Question 16

A team needs Reader access to exactly two Azure resources that are in the same resource group, and they must not gain access to other resources in that group. Which two scope choices are appropriate? Select two.

Accepted Answer

Assign the role at the storage account scope.. Assigning the Reader role at the storage account scope (Option A) grants read-only access only to that storage account, not to other resources in the resource group. Similarly, assigning the Reader role at the Key Vault scope (Option B) grants read-only access only to that Key Vault. Together, these two assignments provide access to exactly the two specified resources without granting access to any other resource in the group. Options C, D, and E would grant access to all resources within the resource group, subscription, or management group, respectively, which does not meet the requirement.

Answer

Assign the role at the resource group scope.

Answer

Assign the role at the subscription scope.

Answer

Assign the role at the management group scope.

Question 17

A project team adds and removes contractors every month. The team wants Azure role assignments to stay the same when individual contractors leave or join, and access should be granted to everyone on the team through one control point. What should the administrator assign the Azure role to?

Accepted Answer

A Microsoft Entra security group. Assigning an Azure role to a Microsoft Entra security group provides a single control point for managing permissions. When contractors join or leave, the administrator only needs to add or remove their user accounts from the group, and the role assignments remain intact. This decouples access from individual user accounts and ensures consistent permissions for the entire team.

Answer

A Microsoft 365 group

Answer

A guest user account

Answer

A managed identity

Question 18

A central audit group must have Reader access for every current and future subscription in the company hierarchy. You want one assignment that will apply broadly as new subscriptions are added. Where should the role be assigned?

Accepted Answer

At the management group that contains the subscriptions. The explanation correctly identifies management group assignment as the right scope. However, the exam trap falsely claims Azure does not support role assignments at tenant root scope; in fact, the tenant root is a management group and supports RBAC assignments, though it may require elevated access.

Answer

At one resource group in each subscription

Answer

At a single resource

Answer

At the tenant root only for one application

Question 19

Based on the exhibit, which lock should the administrator apply to protect the resource group from accidental deletion while still allowing normal updates to the resources inside it?

Accepted Answer

Apply a CanNotDelete lock to rg-payroll-prod.. The CanNotDelete lock (also known as Delete lock) prevents the resource group itself from being deleted while still allowing all updates (including create, modify, and delete operations) on the resources within it. This is the correct choice because the requirement is to protect only the resource group from accidental deletion, not to restrict changes to the resources inside.

Answer

Apply a ReadOnly lock to rg-payroll-prod.

Answer

Apply a tag named Protected=True to rg-payroll-prod.

Answer

Create an Azure Policy assignment that denies all delete operations.

Question 20

An Azure Policy that appends the Environment tag is assigned to a subscription. New virtual machines get the tag, but existing VMs do not. What should the administrator do next?

Accepted Answer

Create a remediation task for the policy assignment. Append effect policies apply only when resources are created or updated and do not support remediation tasks. Remediation tasks are supported only for modify and deployIfNotExists effects. Therefore, creating a remediation task for an append policy is not valid, and none of the listed options is correct. To bring existing VMs into compliance, either replace the policy with a modify or deployIfNotExists effect and then create a remediation task, or manually tag the VMs.

Answer

Remove the policy and reassign it at the resource group scope

Answer

Grant the policy assignment Reader access

Answer

Apply a CanNotDelete lock to the subscription