A contractor needs read-only access to resources in one application resource group. The access must be removed immediately when the contractor is removed from the contractor team. What is the best access strategy?

Assign Reader directly to the contractor's user account at the subscription scope.

This is broader than needed and does not tie access cleanly to team membership.

Assign Contributor to the contractor group at the resource group scope.

Contributor is not read-only and would allow changes that the requirement specifically forbids.

Assign Reader to the contractor group at the management group scope.

Management group scope is wider than necessary and would expose more resources than the contractor needs.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Assign Reader to the Entra ID contractor group at the resource group scope. — The best practice is to assign permissions to an Entra ID group, not to an individual, so access can be managed through membership changes. Using the resource group as the scope keeps the access limited to the application team’s resources, which aligns with least privilege. When the contractor is removed from the group, access is removed without changing the Azure role assignment. Why others are wrong: Assigning directly to the user is harder to manage and audit, especially for temporary staff. Contributor grants write access, which violates the read-only requirement. Management group scope is much broader than needed and could expose many unrelated subscriptions and resource groups.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.