A contractor team changes every few weeks. The administrator wants Azure access to stay the same when individual contractors leave or join, without editing role assignments for each person. What should be assigned the Azure role?

Each contractor user account individually

This gives access directly to each person, so changes to staff require manual role updates.

A device group

Device groups are for device targeting, not for assigning Azure access to people.

An Azure subscription

A subscription is a scope, not an identity, so it cannot be used as the assignee.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: A Microsoft Entra ID security group — Assigning the Azure role to a Microsoft Entra ID security group is the best choice because the role follows the group, not the individual people. When contractors are added to or removed from the group, their access changes automatically without changing the RBAC assignment itself. This is the standard way to simplify administration and reduce mistakes when team membership changes often. Why others are wrong: Direct user assignments create maintenance overhead and are easy to miss when people change. Device groups are not used for granting Azure RBAC to users. A subscription is a management scope, not a security principal, so it cannot receive a role assignment as the identity.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.