A company uses one management group for all production subscriptions. A compliance analyst is a member of an Entra ID group and must view every current and future resource in all production subscriptions, but must not make any changes. Where should you assign the Reader role?

Assign Reader to the compliance analyst's user account at each resource group.

This would work only for the resource groups you remember to configure, and it does not scale well.

Assign Reader to one production subscription and rely on inheritance to cover the others.

A subscription-scope assignment applies only to that subscription, not all subscriptions under the management group.

Assign Reader directly to each resource because resource-level assignments always override broader scopes.

Resource-level assignments do not automatically cover every other resource, and they create unnecessary administrative overhead.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Assign Reader to the Entra ID group at the management group scope. — Management group scope is the narrowest scope that still covers all current and future production subscriptions in that hierarchy. Azure RBAC permissions flow downward from management group to subscription, resource group, and resource. Assigning Reader to the Entra ID group at the management group level keeps administration simple and ensures the analyst can view everything without having write permissions. Why others are wrong: Option A is too manual and can miss resources or newly created groups. Option C only covers one subscription, so it fails the requirement for all production subscriptions. Option D is overly granular and does not provide blanket coverage; it also creates unnecessary maintenance if the environment changes.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.