AZ-104 Manage Azure Identities and Governance Practice Question
A finance application is deployed in a single resource group named rg-finance-app. The team must manage only the resources in that group and must not receive permissions for other resource groups in the subscription. Where should the Contributor role be assigned?
⚠ Common exam trap
Many candidates choose the subscription scope (Option B) thinking it is the simplest way to grant access, but they overlook that it would grant permissions to all resource groups in the subscription, violating the requirement to restrict access to only rg-finance-app.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
At the rg-finance-app resource group scope.
The Contributor role must be assigned at the rg-finance-app resource group scope to restrict permissions exclusively to that group. This ensures the team can manage only the resources within that resource group, without inheriting permissions to other resource groups in the subscription. Role assignments in Azure are inherited from higher scopes (management group, subscription) down to lower scopes, so assigning at the resource group scope is the most specific and restrictive level that meets the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
At the management group that contains the subscription.
Why it's wrong here
A management group is a container for one or more subscriptions, and any role assignment made at that scope is inherited by all subscriptions nested beneath it. By choosing this scope, the team would gain Contributor permissions across every subscription in the management group, including subscriptions and workloads entirely unrelated to the finance application, making this the broadest and least appropriate option for a single-resource-group deployment.
When this WOULD be correct
If the requirement were to grant Contributor permissions to all resources in all subscriptions under a management group (e.g., for a central IT team managing multiple subscriptions), assigning the role at the management group scope would be correct.
- ✗
At the subscription scope.
Why it's wrong here
Assigning Contributor at subscription scope makes the role assignment effective on every resource group and resource within that subscription, not just rg-finance-app. The team would therefore be able to modify or delete unrelated workloads in other resource groups, and even create or remove entire resource groups, which goes far beyond the stated requirement to manage only the finance application's resources.
When this WOULD be correct
If the requirement were to grant the team Contributor permissions across all resources in the entire subscription, such as for a team managing all deployments in a development subscription, then assigning the role at the subscription scope would be correct.
- ✓
At the rg-finance-app resource group scope.
Why this is correct
Resource group scope is the narrowest scope that still covers all resources for the finance application. Any resource inside that group inherits the assignment, while resources in other groups remain unaffected. This gives the team exactly the access needed without expanding permissions to unrelated workloads.
- ✗
At each individual resource in the resource group.
Why it's wrong here
Assigning the Contributor role at each individual resource would grant the team permissions only on those specific resources, but the requirement is to manage *all* resources within the resource group as a collective unit. This approach fails because it does not allow the team to create, delete, or modify the resource group itself or to deploy new resources into it, which is necessary for managing the application lifecycle. It is tempting because it follows the principle of least privilege by scoping permissions narrowly to individual resources, and it would be correct if the team needed to manage only a subset of resources within the group without affecting the group’s structure or other resources.
When this WOULD be correct
If the requirement were to grant permissions only to specific resources (e.g., a single VM and a single storage account) while explicitly denying access to all other resources in the same resource group, then assigning the role at each individual resource scope would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓At the rg-finance-app resource group scope.Correct answer▾
Why this is correct
Resource group scope is the narrowest scope that still covers all resources for the finance application. Any resource inside that group inherits the assignment, while resources in other groups remain unaffected. This gives the team exactly the access needed without expanding permissions to unrelated workloads.
✗At the management group that contains the subscription.Wrong answer — click to see why▾
Why this is wrong here
Assigning Contributor at the management group scope grants permissions to all subscriptions within that management group, not just the rg-finance-app resource group, violating the requirement to restrict access to only that resource group.
★ When this WOULD be the correct answer
If the requirement were to grant Contributor permissions to all resources in all subscriptions under a management group (e.g., for a central IT team managing multiple subscriptions), assigning the role at the management group scope would be correct.
Why candidates choose this
Candidates may think management group scope is necessary to cover the subscription, but they overlook that it also includes other subscriptions, thus granting broader access than intended.
✗At the subscription scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning the Contributor role at the subscription scope grants permissions to all resource groups in the subscription, not just rg-finance-app, violating the requirement to restrict access to only that resource group.
★ When this WOULD be the correct answer
If the requirement were to grant the team Contributor permissions across all resources in the entire subscription, such as for a team managing all deployments in a development subscription, then assigning the role at the subscription scope would be correct.
Why candidates choose this
Candidates may think assigning at the subscription level is simpler and still covers the resource group, overlooking that it also grants access to other resource groups, which is explicitly prohibited in the question.
✗At each individual resource in the resource group.Wrong answer — click to see why▾
Why this is wrong here
Assigning the Contributor role at each individual resource would be overly granular and inefficient; it violates the principle of least privilege by requiring separate assignments for every resource, and it does not cover future resources added to the group.
★ When this WOULD be the correct answer
If the requirement were to grant permissions only to specific resources (e.g., a single VM and a single storage account) while explicitly denying access to all other resources in the same resource group, then assigning the role at each individual resource scope would be appropriate.
Why candidates choose this
Candidates may think that assigning roles at the resource level provides tighter security, not realizing that resource group scope already limits access to that group and is more manageable.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Contributor role
The Contributor role is a built-in Azure role that grants full access to manage resources within a scope but does not allow granting access to other users.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.