AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create an Entra ID security group for the contractor team.

  Why this is correct

  Creating an Entra ID security group for the contractor team is the correct first step because RBAC roles should be assigned to groups, not individuals, to simplify access lifecycle and ensure consistent permissions. Assigning the group a role at the appropriate scope means contractor membership is the single control: adding or removing a user from the group immediately revokes or grants inherited access. This also supports external B2B collaboration accounts for partner users while keeping the assignment centralised.

• ✓

  Assign the Reader role to that group at the application resource group scope.

  Why this is correct

  Assigning the Reader role to that group at the application resource group scope is correct because Reader provides read-only access to all resources within that resource group, and the scope restricts visibility to exactly the application boundary. Resource group scope inherits to all child resources, so the contractor can view VMs, App Services, and storage but cannot modify or delete anything. This granular scoping aligns with least privilege and avoids giving broader subscription-level visibility.

• ✗

  Assign Reader directly to the contractor's user object at the subscription scope.

  Why it's wrong here

  Assigning Reader directly to the contractor's user object at the subscription scope is wrong because subscription scope grants read access to every resource group and resource in the entire subscription, far beyond the application's resource group. Direct user assignments are also an anti-pattern because they are difficult to audit and revoke consistently when the contractor leaves or changes roles. This violates least-privilege principles and creates an unnecessary security risk.

  When this WOULD be correct

  This option would be correct if the question required granting read-only access to all resources within a subscription for a user, and there was no need for group-based management or temporary access. For example: 'A new employee needs read-only access to all resources in the subscription for auditing purposes.'

• ✗

  Assign Contributor at the resource group scope and rely on discipline.

  Why it's wrong here

  Assigning Contributor at the resource group scope is wrong because Contributor includes write actions: it enables the contractor to create, delete, and modify resources, which is far too broad for read-only needs. Relying on discipline is not an acceptable security control because RBAC is preventive and there is no technical barrier to accidental or malicious changes. Even if the contractor only intends to view, any credential compromise would inherit write-level privileges.

  When this WOULD be correct

  If the requirement were for a contractor to have write permissions (e.g., to deploy resources) for a limited time, and the organization uses manual oversight to ensure compliance, then assigning Contributor at the resource group scope could be considered, though still not best practice.

• ✗

  Use a resource lock to limit the contractor to read-only access.

  Why it's wrong here

  Using a resource lock to limit the contractor to read-only access is wrong because resource locks (such as ReadOnly) do not grant any access; they only prevent management operations from being performed on protected resources by users who already have RBAC permissions. A ReadOnly lock applies globally to all users with sufficient permission, not selectively to a contractor, meaning it cannot be used to define who can read a resource. Proper access must come from an RBAC role assignment like Reader, not a lock.

  When this WOULD be correct

  In a scenario where a user already has read access via a role assignment (e.g., Reader) and the administrator wants to prevent accidental deletion or changes to critical resources, a resource lock (e.g., CanNotDelete) would be the correct additional measure.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question