A contractor from a partner company needs read-only access to one application resource group for 14 days. When the contractor leaves the project, access should be removed immediately by removing a single identity from a group. Which two actions should the administrator take? Select two.

Assign Reader directly to the contractor's user object at the subscription scope.

Direct user assignment is harder to revoke consistently and grants broader access than needed. Subscription scope is also wider than the required resource group.

Assign Contributor at the resource group scope and rely on discipline.

Contributor gives write access and is far too broad for a contractor who only needs to view resources. It does not meet least-privilege requirements.

Use a resource lock to limit the contractor to read-only access.

Locks do not grant access to users; they only restrict certain management actions on resources. They cannot replace RBAC assignments for a contractor.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Create an Entra ID security group for the contractor team. — The right approach is to put the contractor into an Entra ID security group and assign Reader to that group at the application resource group scope. Group-based access makes revocation simple because removing the user from the group immediately removes inherited permissions. The resource group scope keeps access narrow, which is exactly what a short-term contractor assignment requires. Why others are wrong: Direct user assignment is less manageable and often wider than necessary. Contributor is far too permissive for a read-only requirement. Resource locks do not grant access at all, so they cannot be used as a substitute for RBAC in this scenario.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.