A cloud operations team in the Corp business unit needs to read all Azure resources in every current and future subscription under the Corp management group to prepare monthly governance reports. They must not gain access to subscriptions that belong to other business units. What scope should the administrator use when assigning the Reader role?

Subscription scope

This limits access to only one subscription and will not cover future subscriptions automatically.

Resource group scope

This is too narrow because it would expose only resources in one resource group.

Resource scope

This is the narrowest scope, but it would only expose a single resource, not an entire business unit.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Management group scope — Management group scope is the right choice because Azure RBAC assignments inherit from management groups to all child subscriptions, resource groups, and resources. Assigning Reader at the Corp management group gives the operations team consistent read access across all current subscriptions in that branch and any new subscriptions placed there later. It also avoids granting access to subscriptions outside that management group, which preserves administrative boundaries and least privilege. Why others are wrong: Subscription scope would cover only one subscription and would not automatically include every subscription under the Corp group. Resource group scope is too narrow for enterprise reporting across many subscriptions. Resource scope is even narrower and fits a single asset, not an organization-wide reporting need.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.