AZ-104 Manage Azure Identities and Governance Practice Question
A contractor must manage only VM1 and VM2 in rg-prod. The contractor must not be able to manage any other resource in the resource group. Which two role assignment scopes should you create? Select two.
⚠ Common exam trap
Candidates often default to assigning roles at the resource group scope for simplicity, overlooking that resource-level scoping is available and required when the goal is to restrict access to individual resources within a group.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the role at the VM1 resource scope.
Assigning the role at the VM1 resource scope (Option A) is correct because Azure RBAC allows you to scope a role assignment to an individual resource, such as a virtual machine. This grants the contractor permissions to manage only VM1, without affecting any other resources in the resource group. The same logic applies to VM2, making the resource-level scope the precise way to restrict management to just those two VMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign the role at the VM1 resource scope.
Why this is correct
In Azure RBAC, a role assignment scoped to a specific resource applies only to that resource. Assigning the Virtual Machine Contributor role (or similar) on VM1's resource ID gives the contractor permission to manage VM1 without inheriting any access to VM2 or any other resource in rg-prod. This satisfies least privilege for VM1, and when combined with an identical assignment on VM2, the contractor's effective scope is exactly those two VMs. This is a correct approach because resource-scope assignments cannot affect sibling resources.
- ✓
Assign the role at the VM2 resource scope.
Why this is correct
This assignment targets VM2's own scope, so the contractor's permissions are limited to VM2's operations such as start, stop, restart, or apply extensions, with no visibility into rg-prod's other resources. Since RBAC scopes do not overlap from one resource to another, this assignment complements the VM1 resource-scope assignment. Together, the two assignments create a composite effective set of permissions covering only VM1 and VM2. It is correct because resource-scope assignments are the narrowest built-in Azure RBAC scope.
- ✗
Assign the role at the rg-prod resource group scope.
Why it's wrong here
Assigning the role at rg-prod scope grants the contractor permission on every resource contained in that resource group, including any network interface (NIC), disk, network security group, or other VM not equal to VM1/VM2. While this is more contained than subscription scope, it still exceeds the requirement because the contractor would be able to manage all current and future resources placed in rg-prod. Resource-group scoped RBAC assignments do not provide object-level filtering; they apply uniformly to every resource within the resource group. Thus it is wrong because the requested minimal access scope is per-VM, not per-resource-group.
When this WOULD be correct
If the requirement were to grant the contractor permissions to manage all resources within rg-prod (e.g., VMs, storage, networking), then assigning the role at the resource group scope would be appropriate.
- ✗
Assign the role at the subscription scope.
Why it's wrong here
A role assignment at subscription scope cascades to all resource groups and resources within the subscription, meaning the contractor would gain management rights over every VM, network interface, storage account, and other resource in rg-prod and any other resource group. This violates the explicit 'only vm1 and vm2' requirement because subscription-scoped assignments override any narrower assignments and cannot be restricted to a subset of resources. Even with conditional access or additional deny assignments, subscription scope is far too broad and would expose unrelated Azure resources.
- ✗
Assign the role at the management group scope.
Why it's wrong here
Management group scope propagates the role assignment down to every subscription in the management group's hierarchy, covering potentially thousands of resources across multiple subscriptions. This is the broadest type of Azure RBAC scope and would grant the contractor full management capabilities on VMs and other services far outside rg-prod. Because management group hierarchy can include rg-prod only as a tiny subset, this scope is unjustifiably expansive. It is incorrect for the same reason as broader scopes generally but specifically because it cascades across subscriptions and management groups.
When this WOULD be correct
A question where a user must manage all resources across multiple subscriptions that belong to the same management group, and the requirement is to grant broad administrative access at a high level.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign the role at the VM1 resource scope.Correct answer▾
Why this is correct
In Azure RBAC, a role assignment scoped to a specific resource applies only to that resource. Assigning the Virtual Machine Contributor role (or similar) on VM1's resource ID gives the contractor permission to manage VM1 without inheriting any access to VM2 or any other resource in rg-prod. This satisfies least privilege for VM1, and when combined with an identical assignment on VM2, the contractor's effective scope is exactly those two VMs. This is a correct approach because resource-scope assignments cannot affect sibling resources.
✗Assign the role at the rg-prod resource group scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning the role at the rg-prod resource group scope would grant the contractor permissions to manage all resources in that resource group, not just VM1 and VM2.
★ When this WOULD be the correct answer
If the requirement were to grant the contractor permissions to manage all resources within rg-prod (e.g., VMs, storage, networking), then assigning the role at the resource group scope would be appropriate.
Why candidates choose this
Candidates may think that assigning a role at the resource group scope is a convenient way to cover multiple VMs, overlooking that it also grants access to other resources in the group.
✗Assign the role at the management group scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning the role at the management group scope would grant the contractor permissions to manage all resources in all subscriptions under that management group, far exceeding the requirement to manage only VM1 and VM2 in rg-prod.
★ When this WOULD be the correct answer
A question where a user must manage all resources across multiple subscriptions that belong to the same management group, and the requirement is to grant broad administrative access at a high level.
Why candidates choose this
Candidates might think management group scope is a convenient way to apply permissions to multiple resources, but they overlook that it applies to all resources under that hierarchy, not just the specified VMs.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.