AZ-104 Manage Azure Identities and Governance Practice Question
A team has 20 operators who need the same Reader access to one application resource group. You want to grant access and later revoke it by changing group membership instead of editing each user's permissions. What should you use for the role assignment?
⚠ Common exam trap
Many candidates confuse management groups (which control policy and cost across subscriptions) with security groups (which control RBAC access at a specific scope), leading them to pick Option C incorrectly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An Entra ID security group
Using an Entra ID security group allows you to assign the Reader role to the group, then add or remove the 20 operators as members. This centralizes permission management: granting or revoking access is done by changing group membership rather than editing individual role assignments, which is more efficient and less error-prone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Individual user accounts
Why it's wrong here
Creating individual role assignments for each of the 20 operators works technically, but it is inefficient and difficult to maintain because every user must be added or removed manually. Any change in team membership requires updating multiple assignments, increasing the risk of orphaned permissions and complicating access reviews. A single security group assignment centralizes identity-based access, supports the principle of least privilege, and makes onboarding or offboarding operators a one-step operation.
When this WOULD be correct
When granting access to a single user or a small number of users where group membership management is not needed, such as assigning a custom role to a specific administrator for a temporary task.
- ✓
An Entra ID security group
Why this is correct
Assigning the role to an Entra ID security group is the best practice for shared access. You manage access by adding or removing users from the group, which is easier to maintain and less error-prone than changing many separate role assignments. This also supports least privilege and makes future access reviews simpler.
- ✗
A management group
Why it's wrong here
A management group is a hierarchical scope used to organize Azure subscriptions for policy, compliance, and cost governance. It is not a security principal, so you cannot assign a role to a management group to grant user access; role assignments are made to users, groups, or service principals, with the management group only serving as the scope. Adding the 20 operators to a management group would apply any assigned role across all resources in that subscription hierarchy, far beyond the single application, violating least privilege.
When this WOULD be correct
You need to apply a policy (e.g., allowed locations) or a role assignment (e.g., Contributor) to all subscriptions under an organization, and you want the assignment to be inherited by all child subscriptions. In that case, assigning the role at the management group scope would be correct.
- ✗
A resource lock
Why it's wrong here
A resource lock is a protection mechanism that prevents deletion or modification of a resource, not a method for granting access. Locks are independent of Azure RBAC and do not authenticate users or assign any read permissions; they only override write/delete operations for users who already have such rights. Using a lock would not give the 20 operators any ability to access the application, and it would actually block authorized changes if applied at the wrong scope.
When this WOULD be correct
A question asks how to prevent accidental deletion of a critical resource group while still allowing authorized users to manage resources within it. The correct answer would be to apply a resource lock (e.g., CanNotDelete) to the resource group.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An Entra ID security groupCorrect answer▾
Why this is correct
Assigning the role to an Entra ID security group is the best practice for shared access. You manage access by adding or removing users from the group, which is easier to maintain and less error-prone than changing many separate role assignments. This also supports least privilege and makes future access reviews simpler.
✗Individual user accountsWrong answer — click to see why▾
Why this is wrong here
Assigning Reader access to individual user accounts would require editing each user's permissions to revoke access, contradicting the requirement to manage access via group membership changes.
★ When this WOULD be the correct answer
When granting access to a single user or a small number of users where group membership management is not needed, such as assigning a custom role to a specific administrator for a temporary task.
Why candidates choose this
Candidates may default to assigning roles directly to users without considering the operational overhead of managing permissions individually, especially when the number of users is manageable.
✗A management groupWrong answer — click to see why▾
Why this is wrong here
A management group is used to organize and manage access, policies, and compliance across multiple Azure subscriptions, not to assign roles to individual users within a single resource group. It cannot be used to grant Reader access to specific operators by changing group membership.
★ When this WOULD be the correct answer
You need to apply a policy (e.g., allowed locations) or a role assignment (e.g., Contributor) to all subscriptions under an organization, and you want the assignment to be inherited by all child subscriptions. In that case, assigning the role at the management group scope would be correct.
Why candidates choose this
Candidates may confuse management groups with security groups, thinking both are 'groups' that can manage access, but management groups are for hierarchical governance across subscriptions, not for granular role assignments to users.
✗A resource lockWrong answer — click to see why▾
Why this is wrong here
A resource lock prevents accidental deletion or modification of resources but does not grant access permissions. It cannot be used to assign Reader access to users.
★ When this WOULD be the correct answer
A question asks how to prevent accidental deletion of a critical resource group while still allowing authorized users to manage resources within it. The correct answer would be to apply a resource lock (e.g., CanNotDelete) to the resource group.
Why candidates choose this
Candidates may confuse resource locks with role assignments because both involve controlling access, but locks are for preventing changes, not granting permissions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
Security group
A security group is a virtual firewall that controls inbound and outbound traffic to AWS resources, such as EC2 instances, based on defined rules.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.