AZ-104 Manage Azure Identities and Governance Practice Question
A company uses one management group for all production subscriptions. A compliance analyst is a member of an Entra ID group and must view every current and future resource in all production subscriptions, but must not make any changes. Where should you assign the Reader role?
⚠ Common exam trap
Watch out — candidates often assume they must assign roles at the subscription or resource group level, overlooking the management group scope which provides inheritance across multiple subscriptions and future resources without manual intervention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign Reader to the Entra ID group at the management group scope.
Assigning the Reader role to the Entra ID group at the management group scope ensures that all current and future resources in all production subscriptions inherit the role via Azure RBAC inheritance. This meets the requirement to view every resource without making changes, as the management group encompasses all production subscriptions and the group membership automatically grants permissions to the compliance analyst.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign Reader to the compliance analyst's user account at each resource group.
Why it's wrong here
Assigning the compliance analyst's user account at each resource group creates a direct, hardcoded dependency that must be manually updated when the analyst changes teams or leaves, and it still only covers the specific resource groups you configure. It does not use an Entra ID security group, so adding another analyst requires repeating the process, and any subscription-level resources or resources outside those resource groups remain inaccessible. This approach violates the principle of using groups for access and fails to scale across the management group hierarchy.
When this WOULD be correct
If the requirement were to grant read-only access to specific resource groups only (e.g., for a project-specific auditor) and not to all current and future resources across all subscriptions, then assigning Reader at each resource group would be appropriate.
- ✓
Assign Reader to the Entra ID group at the management group scope.
Why this is correct
This is the best choice because role assignments inherit from management groups down to subscriptions, resource groups, and resources. By assigning Reader to the Entra ID group at the management group level, every current and future production subscription under that hierarchy will inherit read-only access. Using the group also makes access easier to manage when analysts join or leave the team.
- ✗
Assign Reader to one production subscription and rely on inheritance to cover the others.
Why it's wrong here
Azure RBAC inheritance flows only from a management group down to its child subscriptions, resource groups, and resources. An assignment made on one production subscription is isolated to that subscription and is never replicated to sibling subscriptions under the same management group. To cover all production subscriptions, you must assign the Reader role at the management group scope, or create identical assignments on each subscription individually.
When this WOULD be correct
If the requirement was to grant read access to all resources within a single subscription (not across multiple subscriptions), assigning Reader at the subscription scope would be correct due to inheritance to all resource groups and resources under that subscription.
- ✗
Assign Reader directly to each resource because resource-level assignments always override broader scopes.
Why it's wrong here
Role assignments at the resource scope do not extend to other resources, and they do not 'override' broader scopes; Azure RBAC evaluates all assignments additively, so effective permissions are the union of assignments at all scopes. Assigning Reader to every resource manually is operationally unsustainable, prone to omission, and fails to cover any new resource created after the assignment. It also ignores that management-group or subscription-level reader access would already apply to all resources.
When this WOULD be correct
If the question required granting a custom role with specific permissions on a single resource (e.g., a virtual machine) and explicitly stated that no other resources should be accessible, then assigning the role directly to that resource would be correct to avoid broader inheritance.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign Reader to the Entra ID group at the management group scope.Correct answer▾
Why this is correct
This is the best choice because role assignments inherit from management groups down to subscriptions, resource groups, and resources. By assigning Reader to the Entra ID group at the management group level, every current and future production subscription under that hierarchy will inherit read-only access. Using the group also makes access easier to manage when analysts join or leave the team.
✗Assign Reader to the compliance analyst's user account at each resource group.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader to the compliance analyst's user account at each resource group fails to cover future resources and is inefficient; it also doesn't meet the requirement to view all resources across all production subscriptions.
★ When this WOULD be the correct answer
If the requirement were to grant read-only access to specific resource groups only (e.g., for a project-specific auditor) and not to all current and future resources across all subscriptions, then assigning Reader at each resource group would be appropriate.
Why candidates choose this
Candidates may think that assigning roles at the resource group level is sufficient and more granular, overlooking the need for scalability and coverage of future resources as stated in the question.
✗Assign Reader to one production subscription and rely on inheritance to cover the others.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader to one subscription does not cover other production subscriptions; inheritance only applies within the same hierarchy, not across sibling subscriptions.
★ When this WOULD be the correct answer
If the requirement was to grant read access to all resources within a single subscription (not across multiple subscriptions), assigning Reader at the subscription scope would be correct due to inheritance to all resource groups and resources under that subscription.
Why candidates choose this
Candidates may mistakenly believe that assigning a role at one subscription will inherit to other subscriptions under the same management group, but role assignments do not propagate across sibling subscriptions.
✗Assign Reader directly to each resource because resource-level assignments always override broader scopes.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader directly to each resource is inefficient and violates the principle of least privilege by requiring individual assignments for every resource, which does not scale and does not cover future resources. The question requires viewing all current and future resources, which is best achieved at the management group scope.
★ When this WOULD be the correct answer
If the question required granting a custom role with specific permissions on a single resource (e.g., a virtual machine) and explicitly stated that no other resources should be accessible, then assigning the role directly to that resource would be correct to avoid broader inheritance.
Why candidates choose this
Candidates may mistakenly believe that resource-level assignments are always necessary to ensure precise control, or they may not fully understand that role assignments at higher scopes (management group) inherit to all child resources, including future ones.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to ensure that a finance analyst can view all resources in the Finance-Sub subscription and also view spending details, but cannot create, modify, or delete any resources. Which built-in Azure RBAC role should you assign?
medium- A.Owner
- B.Contributor
- ✓ C.Reader
- D.Virtual Machine Contributor
Why C: The Reader role is the correct choice because it provides read-only access to all resources in a subscription, including the ability to view resource properties and deployment history, but it does not allow any create, modify, or delete operations. Additionally, the Reader role includes the 'Microsoft.CostManagement/views/read' permission, which enables viewing spending details (cost data) in the Azure portal. This aligns exactly with the requirement to view resources and spending without making changes.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.