A contractor should be able to view resources in one resource group for 30 days. When the contract ends, removing the contractor from the group should immediately remove access. What is the best approach?

Assign Reader directly to the contractor's user account at the resource group scope.

Direct user assignments work, but they create extra cleanup work when the contract ends. The requirement specifically asks for access to disappear when the contractor is removed from a group, so direct assignment does not match the management model.

Assign Reader at the subscription scope to the contractor so access is simple.

Subscription scope is broader than necessary and would expose more resources than the contractor needs. It also still relies on a direct user assignment, which does not satisfy the requirement for access to be controlled through group membership.

Create a CanNotDelete lock on the resource group until the contract ends.

A lock prevents certain management operations on resources, but it does not grant or revoke read access for users. It is unrelated to the need to manage contractor identity and RBAC cleanup.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Assign Reader to an Entra ID group and add the contractor to that group. — Assigning the role to an Entra ID group is the most maintainable way to manage temporary access. The contractor can be added to the group for the duration of the engagement, and removal from the group immediately removes the effective permissions without touching the RBAC assignment itself. This pattern is safer and easier to audit than assigning the role directly to a user account. Why others are wrong: Direct user assignments require manual cleanup and do not align with the requirement to control access through group membership. A subscription scope is broader than needed and still does not solve the lifecycle problem. A resource lock does not affect authorization at all, so it cannot be used to manage contractor access.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.