AZ-104 Manage Azure Identities and Governance Practice Question
A contractor is a member of an Entra security group that has the Contributor role on a resource group. When the contractor tries to deploy, the portal says the role is not active. The activation request requires approver approval, and the previous activation window has expired. What should the contractor do?
⚠ Common exam trap
It's easy for candidates to confuse 'eligible' role assignments with 'active' assignments, assuming the role is permanently available when it actually requires manual activation through PIM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Activate the eligible role through Privileged Identity Management and obtain approval if required.
The contractor has an eligible role assignment that requires activation through Privileged Identity Management (PIM). Since the previous activation window has expired, the role is no longer active, and the contractor must initiate a new activation request, which may require approver approval. Option D correctly describes this process, as PIM is the Azure service designed for just-in-time access to privileged roles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wait for the role assignment to propagate to Azure.
Why it's wrong here
Directory replication is not the bottleneck here because the eligibility assignment has already been synced and recognized by PIM. Even after waiting, the user still lacks an active role, because Azure RBAC only honors active assignments or successfully activated PIM roles. Propagation does not turn an eligible assignment into an active one.
When this WOULD be correct
This would be correct if the contractor had just been assigned a direct (non-eligible) Contributor role and the deployment failed due to Azure RBAC propagation delay, typically within 5 minutes.
- ✗
Create a new security group and assign Contributor directly.
Why it's wrong here
Creating a new security group and directly assigning Contributor bypasses the organization's privileged access management controls and audit trail. In many environments, creating role assignments or groups may be restricted by MFA and approval policies, and it also leaves the original eligible assignment unused. This violates the principle of least privilege and does not address the approval workflow that governs the existing role.
When this WOULD be correct
This option would be correct if the question stated that the contractor needs to grant Contributor access to a new user who is not part of any group, and the requirement is to use a group for role assignment to simplify management, without any PIM or eligibility constraints.
- ✗
Sign out of the portal and sign back in only.
Why it's wrong here
Signing out and back in only refreshes the authentication token and does not modify the state of a PIM eligible assignment. The role remains inactive until the contractor triggers the activation workflow and, if applicable, receives approval. Token refresh cannot elevate permissions because Azure RBAC checks the active role assignments at each authorization decision.
When this WOULD be correct
This would be correct if the contractor had an active role assignment that was not yet reflected in the portal due to propagation delay, and the question stated that the role was already active but the portal showed an error.
- ✓
Activate the eligible role through Privileged Identity Management and obtain approval if required.
Why this is correct
The assignment is eligible, not active, so the contractor must initiate an activation request in Microsoft Entra Privileged Identity Management. PIM will enforce any approval workflow configured for the role, and after approval (if required) the role becomes active for a specified duration. This is the only supported way to use an eligible role assignment.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Activate the eligible role through Privileged Identity Management and obtain approval if required.Correct answer▾
Why this is correct
The assignment is eligible, not active, so the contractor must initiate an activation request in Microsoft Entra Privileged Identity Management. PIM will enforce any approval workflow configured for the role, and after approval (if required) the role becomes active for a specified duration. This is the only supported way to use an eligible role assignment.
✗Wait for the role assignment to propagate to Azure.Wrong answer — click to see why▾
Why this is wrong here
The contractor has an eligible role requiring activation via PIM, not a direct assignment. Role propagation delay does not apply because the role is not active; it must be activated first.
★ When this WOULD be the correct answer
This would be correct if the contractor had just been assigned a direct (non-eligible) Contributor role and the deployment failed due to Azure RBAC propagation delay, typically within 5 minutes.
Why candidates choose this
Candidates may confuse eligible role activation with direct role assignment propagation, assuming a delay is the cause when the real issue is that the role is not active.
✗Create a new security group and assign Contributor directly.Wrong answer — click to see why▾
Why this is wrong here
Creating a new security group and assigning Contributor directly would not resolve the issue because the contractor's role is eligible and requires activation through Privileged Identity Management (PIM), not a new group assignment.
★ When this WOULD be the correct answer
This option would be correct if the question stated that the contractor needs to grant Contributor access to a new user who is not part of any group, and the requirement is to use a group for role assignment to simplify management, without any PIM or eligibility constraints.
Why candidates choose this
Candidates may think that a direct role assignment to a new group bypasses the activation requirement, misunderstanding that the eligibility is tied to the user's role assignment, not the group membership.
✗Sign out of the portal and sign back in only.Wrong answer — click to see why▾
Why this is wrong here
Signing out and back in does not resolve the issue because the contractor's role is eligible, not active. The portal error indicates the role requires activation through Privileged Identity Management (PIM), not a session refresh.
★ When this WOULD be the correct answer
This would be correct if the contractor had an active role assignment that was not yet reflected in the portal due to propagation delay, and the question stated that the role was already active but the portal showed an error.
Why candidates choose this
Candidates may think a simple sign-out/sign-in refreshes cached permissions or group memberships, similar to how it can resolve some access token issues in other scenarios.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
PIM
Privileged Identity Management, a Microsoft Azure Active Directory tool that manages, monitors, and controls access to privileged roles on a just-in-time basis.
Key term
Role assignment
Role assignment is the process of granting a specific set of permissions to a user, group, or service principal so they can perform certain actions within a system.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.