AZ-104 Manage Azure Identities and Governance Practice Question
A finance analyst needs read-only access to one storage account named stprod01. The analyst must not see other resources in the subscription. Where should you assign the Reader role?
⚠ Common exam trap
Candidates often assume assigning the Reader role at the resource group scope is sufficient, but this would grant access to all resources in that resource group, not just the single storage account, violating the 'must not see other resources' constraint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
At the storage account resource scope
Assigning the Reader role at the storage account resource scope (stprod01) grants read-only access exclusively to that specific storage account. This meets the requirement of restricting the analyst from seeing any other resources in the subscription, as role assignments at a higher scope (e.g., resource group, subscription, management group) would inherit permissions to all resources under that scope.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
At the management group scope that contains the subscription
Why it's wrong here
A management group is a hierarchical container that holds multiple subscriptions, so placing the Reader role at that scope applies to every subscription and each resource under those subscriptions. This is dramatically broader than the finance analyst's need, granting read-only visibility into possibly an entire enterprise's Azure estate, including policy assignments and management group metadata. It also introduces unnecessary audit and security risks because the analyst could see resources across organizational boundaries well outside the single storage account they are meant to access.
When this WOULD be correct
If the question required granting read-only access to all resources across multiple subscriptions under a management group, such as for a compliance auditor who needs visibility into all subscriptions, then assigning the Reader role at the management group scope would be correct.
- ✗
At the subscription scope that contains the storage account
Why it's wrong here
Subscription scope assigns Reader to every resource group and every resource within the subscription, meaning the analyst could view all storage accounts, virtual machines, databases, and other services across the entire subscription. This exposes the full inventory of the environment, including resource names, locations, tags, and configuration settings that are irrelevant to the finance analyst's task. The subscription-level assignment is wider than the required resource-level access and does not target permissions narrowly to the single storage account, creating unnecessary visibility and a larger attack surface.
When this WOULD be correct
If the question required granting read-only access to all resources within a subscription (e.g., for a security auditor to review all configurations), assigning the Reader role at the subscription scope would be correct.
- ✗
At the resource group that contains the storage account
Why it's wrong here
Assigning Reader at the resource group scope grants read access to every resource within that group, including virtual networks, VMs, and other storage accounts, not just the target storage account. Because RBAC permissions assigned at a resource group scope inherit to all child resources, the analyst would be able to enumerate and inspect metadata for unrelated infrastructure. This violates the principle of least privilege because the requirement is strictly limited to one storage account, and a resource-group-level assignment broadens visibility to an entire collection of resources.
When this WOULD be correct
If the question required read-only access to all resources within a specific resource group (e.g., all storage accounts and other services in that group) and did not restrict visibility to a single storage account, assigning the Reader role at the resource group scope would be correct.
- ✓
At the storage account resource scope
Why this is correct
Assigning Reader at the storage account scope is the narrowest option that still provides read-only access to that single resource. Azure RBAC permissions inherit downward, so a resource-level assignment affects only that storage account and nothing else in the subscription. This matches the requirement to limit visibility and access as tightly as possible.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓At the storage account resource scopeCorrect answer▾
Why this is correct
Assigning Reader at the storage account scope is the narrowest option that still provides read-only access to that single resource. Azure RBAC permissions inherit downward, so a resource-level assignment affects only that storage account and nothing else in the subscription. This matches the requirement to limit visibility and access as tightly as possible.
✗At the management group scope that contains the subscriptionWrong answer — click to see why▾
Why this is wrong here
Assigning the Reader role at the management group scope grants read access to all resources in all subscriptions under that management group, including the storage account, but also exposes other resources, violating the requirement that the analyst must not see other resources.
★ When this WOULD be the correct answer
If the question required granting read-only access to all resources across multiple subscriptions under a management group, such as for a compliance auditor who needs visibility into all subscriptions, then assigning the Reader role at the management group scope would be correct.
Why candidates choose this
Candidates may think that a broader scope like management group is more efficient or 'safe' because it covers the storage account, but they overlook the requirement to restrict visibility to only that specific storage account.
✗At the subscription scope that contains the storage accountWrong answer — click to see why▾
Why this is wrong here
Assigning the Reader role at the subscription scope grants read access to all resources in the subscription, including other storage accounts and resources, which violates the requirement that the analyst must not see other resources.
★ When this WOULD be the correct answer
If the question required granting read-only access to all resources within a subscription (e.g., for a security auditor to review all configurations), assigning the Reader role at the subscription scope would be correct.
Why candidates choose this
Candidates may think assigning at a higher scope is simpler or covers the storage account, overlooking the requirement to restrict visibility to only that specific storage account.
✗At the resource group that contains the storage accountWrong answer — click to see why▾
Why this is wrong here
Assigning the Reader role at the resource group scope grants read access to all resources within that resource group, including other storage accounts, virtual networks, or VMs, which violates the requirement that the analyst must not see other resources.
★ When this WOULD be the correct answer
If the question required read-only access to all resources within a specific resource group (e.g., all storage accounts and other services in that group) and did not restrict visibility to a single storage account, assigning the Reader role at the resource group scope would be correct.
Why candidates choose this
Candidates may think that since the storage account is in a resource group, assigning the role at the resource group level is sufficient and simpler, overlooking that it grants access to all resources in that group, not just the target storage account.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.