AZ-104 Manage Azure Identities and Governance Practice Question
A contractor should be able to view resources in one resource group for 30 days. When the contract ends, removing the contractor from the group should immediately remove access. What is the best approach?
⚠ Common exam trap
Test-takers frequently confuse access control mechanisms, mistakenly thinking a resource lock (CanNotDelete) can restrict read access, or that assigning a role at a broader scope is simpler without considering the security implications of over-permissioning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign Reader to an Entra ID group and add the contractor to that group.
Assigning the Reader role to an Entra ID group and adding the contractor as a member allows centralized access management. When the contractor is removed from the group, the role assignment is immediately revoked because Azure RBAC evaluates group membership at the time of authorization. This meets the 30-day requirement and ensures instant access removal upon contract termination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign Reader directly to the contractor's user account at the resource group scope.
Why it's wrong here
Direct user assignments work, but they create extra cleanup work when the contract ends. The requirement specifically asks for access to disappear when the contractor is removed from a group, so direct assignment does not match the management model.
When this WOULD be correct
This option would be correct if the requirement was to grant access to a single user for a fixed period without needing to manage group membership, and immediate removal was not a strict requirement (e.g., access could be removed later via a scheduled task).
- ✓
Assign Reader to an Entra ID group and add the contractor to that group.
Why this is correct
Group-based role assignment is the best operational choice because access follows group membership rather than individual user objects. When the contractor is removed from the group, the RBAC assignment no longer applies to that person. It also makes temporary access easier to manage and reduces the risk of forgotten direct permissions.
- ✗
Assign Reader at the subscription scope to the contractor so access is simple.
Why it's wrong here
Subscription scope is broader than necessary and would expose more resources than the contractor needs. It also still relies on a direct user assignment, which does not satisfy the requirement for access to be controlled through group membership.
When this WOULD be correct
If the question required the contractor to view all resources across the entire subscription for 30 days, assigning Reader at the subscription scope would be the simplest and correct approach.
- ✗
Create a CanNotDelete lock on the resource group until the contract ends.
Why it's wrong here
A CanNotDelete lock is an Azure resource lock that blocks deletion of the resource group or its resources, but it does not control identity-based access. Locks operate at the management plane and prevent certain operations regardless of the user's RBAC permissions; they cannot grant read access. Even if a lock is in place, a user without the Reader role cannot list or view resources, and the lock does not automatically remove access when a contract ends. Thus, the lock is irrelevant to the requirement of managing the contractor's viewing permissions via group membership.
When this WOULD be correct
If the question required preventing accidental deletion of resources in the resource group for a specific period, and access control was not a concern, a CanNotDelete lock would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign Reader to an Entra ID group and add the contractor to that group.Correct answer▾
Why this is correct
Group-based role assignment is the best operational choice because access follows group membership rather than individual user objects. When the contractor is removed from the group, the RBAC assignment no longer applies to that person. It also makes temporary access easier to manage and reduces the risk of forgotten direct permissions.
✗Assign Reader directly to the contractor's user account at the resource group scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader directly to the contractor's user account at the resource group scope does not allow for immediate removal of access when the contract ends; you would need to manually remove the assignment, which can be delayed or overlooked.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to grant access to a single user for a fixed period without needing to manage group membership, and immediate removal was not a strict requirement (e.g., access could be removed later via a scheduled task).
Why candidates choose this
Candidates may think direct assignment is simpler and faster, overlooking the need for centralized management and immediate revocation that group-based assignment provides.
✗Assign Reader at the subscription scope to the contractor so access is simple.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader at the subscription scope grants access to all resource groups in the subscription, violating the requirement to limit access to only one resource group.
★ When this WOULD be the correct answer
If the question required the contractor to view all resources across the entire subscription for 30 days, assigning Reader at the subscription scope would be the simplest and correct approach.
Why candidates choose this
Candidates may think subscription-level assignment is simpler and still meets the 30-day requirement, overlooking the need to restrict access to a single resource group.
✗Create a CanNotDelete lock on the resource group until the contract ends.Wrong answer — click to see why▾
Why this is wrong here
A CanNotDelete lock prevents resource deletion but does not control access; the contractor would still have access after the contract ends, and removing the lock does not remove access.
★ When this WOULD be the correct answer
If the question required preventing accidental deletion of resources in the resource group for a specific period, and access control was not a concern, a CanNotDelete lock would be appropriate.
Why candidates choose this
Candidates may confuse resource locks with access control, thinking a lock can restrict user actions like viewing or deleting, when locks only affect deletion or modification, not read access.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Reader role
A Reader role is a predefined set of permissions in identity and governance systems that allows a user to view resources and data but not create, modify, or delete anything.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.