20+ practice questions focused on Manage Azure Identities and Governance — one of the most tested topics on the AZ-104 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Manage Azure Identities and Governance PracticeYour company has an Azure subscription named Prod-Sub. You create a custom role that allows users to restart virtual machines but not create, delete, or resize them. You need to ensure that members of the VMOperators group can use this custom role only for virtual machines in the RG-Prod resource group. What should you do?
Explanation: Option B is correct because assigning the custom role at the RG-Prod scope restricts the role's permissions to only the virtual machines within that specific resource group. This meets the requirement that VMOperators can restart VMs but not create, delete, or resize them, and only within RG-Prod.
Your organization assigns an Azure Policy at the Corp-MG management group to require the tag Environment on all newly created resources. A deployment to RG-App in the Prod-Sub subscription fails because the tag is missing. You need to allow this single deployment to proceed without weakening enforcement for the rest of the organization. What should you do?
Explanation: A policy exemption allows you to exclude a specific scope (like Prod-Sub or RG-App) from the enforcement of a policy assignment without modifying or removing the policy itself. This lets the single deployment proceed while maintaining the Deny effect for all other resources under Corp-MG. Exemptions can be created with an expiration date to ensure temporary relief does not become permanent.
A help desk team must be able to reset passwords for cloud users in Microsoft Entra ID, but they must not be able to create or delete users. Which built-in role should you assign?
Explanation: The User Administrator role in Microsoft Entra ID (formerly Azure AD) grants permissions to reset passwords for cloud users, but explicitly excludes the ability to create or delete users. This makes it the correct choice for a help desk team that needs password reset capabilities without broader user management rights.
You need to assign the same RBAC role to 15 administrators so they can manage backups for several virtual machines. You want to minimize ongoing administrative effort when membership changes. What should you use?
Explanation: Option A is correct because assigning a single RBAC role to a Microsoft Entra group allows you to manage permissions centrally. When membership changes, you only need to add or remove users from the group, and the role assignment automatically applies to the new members. This minimizes ongoing administrative effort compared to managing individual role assignments.
A storage account named stfinance01 contains critical data. Administrators must still be able to read and modify the data, but no one should be able to delete the storage account accidentally. What should you configure?
Explanation: A CanNotDelete lock on stfinance01 prevents the storage account from being deleted while still allowing administrators to read and modify data. This lock type blocks delete operations at the resource level, but does not restrict read or write access, which is exactly what the requirement specifies.
+15 more Manage Azure Identities and Governance questions available
Practice all Manage Azure Identities and Governance questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Manage Azure Identities and Governance. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Manage Azure Identities and Governance questions on the AZ-104 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Manage Azure Identities and Governance is tested as part of the AZ-104 blueprint. Practicing with targeted Manage Azure Identities and Governance questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free AZ-104 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Manage Azure Identities and Governance is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Manage Azure Identities and Governance practice session with instant scoring and detailed explanations.
Start Manage Azure Identities and Governance Practice →