A contractor pool changes every month. The operations team wants Azure role access to stay the same when people join or leave, without editing role assignments for each person. Which two actions should the administrator take? Select two.

Assign the Azure role directly to each contractor account.

Direct user assignments work, but they create maintenance overhead whenever contractors join or leave. That approach does not satisfy the goal of avoiding frequent role assignment changes for individual people.

Create a Microsoft 365 group and use it for VM sign-in.

Microsoft 365 groups are not the standard choice for Azure RBAC delegation tasks. They are oriented toward collaboration services, not least-privilege access administration for Azure resources.

Use a user-assigned managed identity for each contractor.

Managed identities are for Azure resources, not human contractors. They are attached to workloads, so they do not solve human access delegation or membership-based administration.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Create a security group in Microsoft Entra ID for the contractor pool. — To reduce ongoing administration, Azure RBAC should be assigned to a security group rather than to each person. The security group becomes the stable access boundary, while contractor turnover is handled only by updating group membership in Microsoft Entra ID. This pattern is the standard way to keep access consistent when users change frequently and avoids repeated role reassignment work. Why others are wrong: Per-user role assignments create unnecessary maintenance, and Microsoft 365 groups are not the preferred identity object for RBAC delegation. Managed identities are tied to Azure workloads, not contractor accounts. The key design choice is to keep the role assignment stable and move user churn into group membership changes instead.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.