AZ-104 Manage Azure Identities and Governance Practice Question
A contractor needs read-only access to resources in one application resource group. The access must be removed immediately when the contractor is removed from the contractor team. What is the best access strategy?
⚠ Common exam trap
Many exam-takers choose a broader scope (subscription or management group) thinking it simplifies management, but they overlook the requirement to restrict access to only one resource group, which is a classic Azure RBAC scope misunderstanding.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign Reader to the Entra ID contractor group at the resource group scope.
Assigning the Reader role to the Entra ID contractor group at the resource group scope ensures that all members of the group inherit read-only access to resources within that specific resource group. When a contractor is removed from the Entra ID group, their access is immediately revoked because Azure RBAC evaluates group membership dynamically at authentication time. This approach follows the principle of least privilege and enables centralized access management via group-based assignments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign Reader directly to the contractor's user account at the subscription scope.
Why it's wrong here
Assigning Reader directly to the contractor's user account at the subscription scope bypasses group-based management and exposes all resource groups in the subscription, including those unrelated to the contractor's role. Direct user assignments create administrative overhead during personnel changes, as each user must be manually updated or removed instead of simply adding or removing them from a central Entra ID group. The correct assignment should target the contractor group at the resource group scope to achieve least privilege and simplify access reviews.
When this WOULD be correct
This option would be correct if the requirement was to provide read-only access to all resources within the entire subscription, and the contractor's access could be managed individually (e.g., via a separate process for immediate removal).
- ✓
Assign Reader to the Entra ID contractor group at the resource group scope.
Why this is correct
This is the best practice because Azure RBAC supports group-based assignments, and scope should be as narrow as possible. Assigning Reader to the contractor group at the resource group gives the team exactly the access needed and ensures removal from the group immediately revokes access through group membership changes. It is easier to audit and manage than assigning permissions to individual contractor accounts.
- ✗
Assign Contributor to the contractor group at the resource group scope.
Why it's wrong here
The Contributor role at the resource group scope grants full management rights to all resources in that resource group, including the ability to create, delete, and modify resources—directly contradicting the read-only requirement. Contributor also allows altering the configuration of existing resources, which could cause unintended outages or security changes, even though it cannot assign roles to others. Reader is the only built-in role that provides read-only access, and it must be assigned at the appropriate scope.
When this WOULD be correct
If the contractor needed to deploy and manage resources (e.g., create VMs, modify settings) within the resource group, Contributor at the resource group scope would be correct, and immediate removal could be achieved by removing the user from the group.
- ✗
Assign Reader to the contractor group at the management group scope.
Why it's wrong here
Assigning Reader to the contractor group at the management group scope places the role assignment on the root container, causing the role to be inherited by every subscription and resource group beneath it. This violates least privilege because the contractor would gain read access to unrelated resources across the entire management hierarchy, not just the single resource group. While group-based assignment is the correct approach, the scope must be narrowed to the specific resource group to limit the blast radius.
When this WOULD be correct
This option would be correct if the question required granting read-only access to all resources across multiple subscriptions under a management group, and the access should be removed when the user is removed from the contractor group. For example: 'A contractor needs read-only access to all resources in all subscriptions under the Production management group. Access must be removed when the contractor leaves the contractor team.'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign Reader to the Entra ID contractor group at the resource group scope.Correct answer▾
Why this is correct
This is the best practice because Azure RBAC supports group-based assignments, and scope should be as narrow as possible. Assigning Reader to the contractor group at the resource group gives the team exactly the access needed and ensures removal from the group immediately revokes access through group membership changes. It is easier to audit and manage than assigning permissions to individual contractor accounts.
✗Assign Reader directly to the contractor's user account at the subscription scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader at the subscription scope grants read-only access to all resource groups in the subscription, which violates the requirement of limiting access to only one application resource group. Additionally, assigning directly to the user account does not leverage group-based access, making immediate removal upon contractor departure less efficient.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to provide read-only access to all resources within the entire subscription, and the contractor's access could be managed individually (e.g., via a separate process for immediate removal).
Why candidates choose this
Candidates may think that assigning the Reader role at a higher scope (subscription) is simpler and still provides read-only access, overlooking the need to restrict access to a single resource group. They might also underestimate the importance of using groups for access management.
✗Assign Contributor to the contractor group at the resource group scope.Wrong answer — click to see why▾
Why this is wrong here
Contributor provides write/delete permissions, exceeding the required read-only access. The question explicitly requires read-only access, making Contributor inappropriate.
★ When this WOULD be the correct answer
If the contractor needed to deploy and manage resources (e.g., create VMs, modify settings) within the resource group, Contributor at the resource group scope would be correct, and immediate removal could be achieved by removing the user from the group.
Why candidates choose this
Candidates may confuse Contributor with Reader, or think that a higher privilege is safer for 'immediate removal' scenarios, not realizing that least privilege should still apply.
✗Assign Reader to the contractor group at the management group scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader at the management group scope grants read-only access to all subscriptions and resource groups under that management group, which is broader than the required single application resource group. It also does not ensure immediate removal when the contractor is removed from the contractor team, as the assignment is at the management group level, not tied to the group.
★ When this WOULD be the correct answer
This option would be correct if the question required granting read-only access to all resources across multiple subscriptions under a management group, and the access should be removed when the user is removed from the contractor group. For example: 'A contractor needs read-only access to all resources in all subscriptions under the Production management group. Access must be removed when the contractor leaves the contractor team.'
Why candidates choose this
Candidates may think management group scope is appropriate because it covers the resource group indirectly, or they may confuse management groups with resource groups. They might also assume that assigning at a higher scope is more efficient without considering the principle of least privilege.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.