A team has 20 operators who need the same Reader access to one application resource group. You want to grant access and later revoke it by changing group membership instead of editing each user's permissions. What should you use for the role assignment?

Individual user accounts

This works, but it creates unnecessary administrative work when users join or leave the team.

A management group

A management group is a scope, not a principal, and it is not where you place team membership for a role assignment.

A resource lock

A lock protects resources from changes or deletion and does not grant user access at all.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: An Entra ID security group — Use an Entra ID security group when multiple users need the same role and you want to manage access centrally. The role assignment is made to the group at the appropriate scope, and then team membership becomes the control point for granting or revoking access. This is cleaner than assigning permissions to each user individually and aligns with standard Azure administration practice. Why others are wrong: Individual users are harder to maintain at scale and increase the chance of missed revocations. A management group is a scope boundary, not a user or group object that receives membership. A resource lock has nothing to do with authorization. The question asks how to simplify access administration, which is exactly what group-based role assignments solve.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.