AZ-104 Manage Azure Identities and Governance Practice Question
A company has 12 subscriptions under one management group. An external auditor needs Reader access to resources in every current and future subscription under that management group. Where should you assign the role?
⚠ Common exam trap
A common mix-up: candidates think assigning the role at the subscription scope is sufficient, overlooking the requirement for future subscriptions, or they may incorrectly believe that management group scope assignments do not propagate to child subscriptions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
At the management group scope
Assigning the Reader role at the management group scope ensures that the external auditor inherits read-only access to all current and future subscriptions under that management group. Role assignments at the management group scope are inherited by all child subscriptions and resource groups, making it the single, scalable solution for the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
At each resource group in each subscription
Why it's wrong here
Creating Reader assignments on every resource group in every subscription would technically grant the auditor access, but it is operationally inefficient and error-prone. You would have to manually enumerate each existing resource group, and any newly created resource group would be missed until a new assignment is added. The auditor might encounter resources that are accessible only at the resource group scope? Actually, all resources reside in a resource group, but if a resource is moved between resource groups, assignments must be updated. A management group assignment eliminates this constant maintenance and ensures complete coverage automatically.
When this WOULD be correct
If the requirement was to grant Reader access only to specific resource groups within a single subscription, and future resources were not a concern, then assigning the role at each resource group scope would be appropriate.
- ✓
At the management group scope
Why this is correct
A role assignment at the management group scope inherits to all subscriptions and resources below it. Because the requirement includes both current and future subscriptions, the management group is the right place to assign Reader. This centralizes access management and avoids creating separate assignments for each subscription or resource group.
- ✗
At one subscription scope only
Why it's wrong here
A single subscription scope assignment applies only to the resources in that one subscription. Because the auditor must access all 12 subscriptions under the management group, this leaves 11 subscriptions completely uncovered. Role assignments are inherited downward, never upward, so assigning at a subscription scope cannot provide any access to sibling subscriptions under the same management group. This option also fails to cover any future subscriptions added later.
When this WOULD be correct
If the requirement were to grant access only to resources within a specific subscription (e.g., for auditing that subscription alone) and not to others or future subscriptions, then assigning the role at that subscription scope would be correct.
- ✗
At one resource scope in the first subscription
Why it's wrong here
A resource-scoped role assignment restricts access to a single resource, such as one virtual machine or storage account, within the first subscription. It does not grant access to any other resource in the same resource group, nor to any resource in the rest of that subscription, let alone the other 11 subscriptions. Even if that resource happens to be in a subscription, the auditor needs read-only visibility across the entire management group hierarchy, which this narrow scope cannot provide.
When this WOULD be correct
If the requirement were to grant Reader access only to a specific resource (e.g., a virtual machine) in the first subscription, and no other resources or subscriptions, then assigning at that resource scope would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓At the management group scopeCorrect answer▾
Why this is correct
A role assignment at the management group scope inherits to all subscriptions and resources below it. Because the requirement includes both current and future subscriptions, the management group is the right place to assign Reader. This centralizes access management and avoids creating separate assignments for each subscription or resource group.
✗At each resource group in each subscriptionWrong answer — click to see why▾
Why this is wrong here
Assigning Reader at each resource group fails to cover future subscriptions and resources not in those resource groups, violating the requirement for access to all current and future subscriptions under the management group.
★ When this WOULD be the correct answer
If the requirement was to grant Reader access only to specific resource groups within a single subscription, and future resources were not a concern, then assigning the role at each resource group scope would be appropriate.
Why candidates choose this
Candidates may think granular control is better and assume assigning at resource group level is sufficient, overlooking the need for scalability and future-proofing across multiple subscriptions.
✗At one subscription scope onlyWrong answer — click to see why▾
Why this is wrong here
Assigning at one subscription scope only grants access to that single subscription, not to all 12 current subscriptions or any future ones under the management group.
★ When this WOULD be the correct answer
If the requirement were to grant access only to resources within a specific subscription (e.g., for auditing that subscription alone) and not to others or future subscriptions, then assigning the role at that subscription scope would be correct.
Why candidates choose this
Candidates may think that assigning at one subscription is sufficient because they overlook the need for access to all subscriptions and future ones, or they misunderstand the inheritance of management group scopes.
✗At one resource scope in the first subscriptionWrong answer — click to see why▾
Why this is wrong here
Assigning Reader at a single resource scope in one subscription does not grant access to other subscriptions or future subscriptions under the management group, failing to meet the requirement for all current and future subscriptions.
★ When this WOULD be the correct answer
If the requirement were to grant Reader access only to a specific resource (e.g., a virtual machine) in the first subscription, and no other resources or subscriptions, then assigning at that resource scope would be correct.
Why candidates choose this
Candidates may think that assigning at a resource scope is sufficient for that resource, but overlook the need for broader access across multiple subscriptions and future resources.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
Key term
Reader role
A Reader role is a predefined set of permissions in identity and governance systems that allows a user to view resources and data but not create, modify, or delete anything.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.