AZ-104 Manage Azure Identities and Governance Practice Question
A contractor team changes every few weeks. The administrator wants Azure access to stay the same when individual contractors leave or join, without editing role assignments for each person. What should be assigned the Azure role?
⚠ Common exam trap
Many candidates think assigning roles to individual user accounts is simpler, but the question specifically requires a solution that avoids editing role assignments when contractors change, making group-based assignment the only correct answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Microsoft Entra ID security group
Assigning the Azure role to a Microsoft Entra ID security group allows the administrator to manage access by adding or removing contractors from the group, rather than editing individual role assignments. This approach ensures that role assignments remain unchanged when contractors leave or join, as the group itself retains the role. It leverages Azure RBAC's support for group-based access control, which is the recommended method for dynamic teams.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Each contractor user account individually
Why it's wrong here
Adding each contractor user account individually as an assignee means you must manually add and remove role assignments whenever team members change. This creates significant administrative overhead, risks orphaned permissions, and violates the principle of least privilege because stale access persists. Direct assignments are fragmented and unscalable, especially with a team that regenerates every few weeks, whereas a group centralizes the lifecycle.
When this WOULD be correct
If the question specified that each contractor needs unique permissions based on their specific role or project, and the team is stable with no frequent changes, then assigning roles to individual user accounts would be appropriate.
- ✓
A Microsoft Entra ID security group
Why this is correct
Assigning RBAC roles to a Microsoft Entra ID security group is a best practice because the group acts as a stable security principal. When contractors join or leave the team, you only update group membership—via manual, dynamic, or group-based assignment—while the role assignments remain unchanged. This decouples identity lifecycle from permission management, ensuring access stays accurate without editing role assignments each time.
- ✗
A device group
Why it's wrong here
A device group is used for targeting devices in scenarios like Microsoft Intune or conditional access policies, not for assigning Azure resource access to human identities. Azure RBAC does not accept device groups as assignees because device objects lack the security principal context needed for identity-based authorization. Therefore, this approach cannot grant permissions to contractors and is fundamentally mismatched to the requirement.
When this WOULD be correct
A question asks: 'You need to ensure that only corporate-owned, compliant devices can access company resources. What should you configure in Microsoft Entra ID?' In that scenario, a device group would be correct for conditional access policies.
- ✗
An Azure subscription
Why it's wrong here
An Azure subscription is a management and billing scope that contains resources, not an identity or security principal. While you can assign roles at the subscription scope, the assignee must be a user, group, service principal, or managed identity—never the subscription itself. Treating a subscription as the assignee misinterprets Azure RBAC's model, making this option invalid for granting access to contractors.
When this WOULD be correct
A question asks: 'You need to grant a team access to all resources in a subscription. What should you assign the role to?' In that case, assigning the role to the subscription itself would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Microsoft Entra ID security groupCorrect answer▾
Why this is correct
Assigning RBAC roles to a Microsoft Entra ID security group is a best practice because the group acts as a stable security principal. When contractors join or leave the team, you only update group membership—via manual, dynamic, or group-based assignment—while the role assignments remain unchanged. This decouples identity lifecycle from permission management, ensuring access stays accurate without editing role assignments each time.
✗Each contractor user account individuallyWrong answer — click to see why▾
Why this is wrong here
Assigning roles to individual contractor accounts requires manual updates each time a contractor leaves or joins, which contradicts the requirement to maintain consistent access without editing role assignments.
★ When this WOULD be the correct answer
If the question specified that each contractor needs unique permissions based on their specific role or project, and the team is stable with no frequent changes, then assigning roles to individual user accounts would be appropriate.
Why candidates choose this
Candidates may think that roles must be assigned directly to user accounts because that is the most straightforward method, overlooking the administrative overhead of managing individual assignments for a frequently changing team.
✗A device groupWrong answer — click to see why▾
Why this is wrong here
Device groups are used for managing device compliance and configuration policies, not for assigning Azure role-based access control (RBAC) permissions to users. They cannot grant Azure resource access to contractors.
★ When this WOULD be the correct answer
A question asks: 'You need to ensure that only corporate-owned, compliant devices can access company resources. What should you configure in Microsoft Entra ID?' In that scenario, a device group would be correct for conditional access policies.
Why candidates choose this
Candidates may confuse device groups with security groups, thinking that since devices can be assigned to groups, those groups can also hold Azure roles. They overlook that Azure RBAC roles are assigned to security principals (users, groups, service principals), not devices.
✗An Azure subscriptionWrong answer — click to see why▾
Why this is wrong here
Assigning an Azure role to an Azure subscription would grant access to all resources in that subscription, not just the contractor team, and does not address the need to manage access for a dynamic group of contractors without editing role assignments.
★ When this WOULD be the correct answer
A question asks: 'You need to grant a team access to all resources in a subscription. What should you assign the role to?' In that case, assigning the role to the subscription itself would be correct.
Why candidates choose this
Candidates may think that assigning a role at the subscription level is a broad and simple way to grant access to a team, overlooking that it affects all users and resources in the subscription, not just the contractor group.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Security group
A security group is a virtual firewall that controls inbound and outbound traffic to AWS resources, such as EC2 instances, based on defined rules.
Key term
Azure role
An Azure role is a set of permissions that defines what actions a user, group, or application can perform on specific Azure resources.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to assign the same RBAC role to 15 administrators so they can manage backups for several virtual machines. You want to minimize ongoing administrative effort when membership changes. What should you use?
easy- ✓ A.A Microsoft Entra group and a single role assignment to the group.
- B.A separate custom role assignment for each administrator.
- C.A resource lock on every virtual machine.
- D.A policy exemption for the administrators.
Why A: Assigning a single RBAC role to a Microsoft Entra group allows you to manage permissions centrally. When membership changes, you only need to add or remove users from the group, and the role assignment automatically applies to the new members. This minimizes ongoing administrative effort compared to managing individual role assignments.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.