An enterprise has a management group named Corp. Corp contains two child management groups: Prod and Sandbox. A compliance auditor is a member of an Entra ID group and must have read-only access to every current and future resource in all subscriptions that are under Prod. The auditor must not see resources in Sandbox, and the admin does not want to maintain separate assignments for each new subscription. What should the administrator do?

Assign the Reader role to the group at each subscription scope under Prod.

This would work for the subscriptions that exist today, but it creates ongoing administrative overhead. Any new subscription added under Prod would need another assignment, so it does not satisfy the requirement to avoid repeated work.

Assign the Reader role to the group at the Corp management group scope.

That scope is too broad because it would include both Prod and Sandbox. The auditor would gain visibility beyond the requested boundary, which violates the requirement to exclude Sandbox resources.

Assign the Reader role to the group at one resource group in each Prod subscription.

A resource-group assignment is too narrow and would miss the rest of each subscription. It also fails the requirement for future subscriptions because each new subscription would require manual assignments to multiple resource groups.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Assign the Reader role to the group at the Prod management group scope. — Azure RBAC scopes inherit from management group to subscription to resource group to resource. Assigning Reader at the Prod management group scope gives the group read access to every current and future subscription placed under Prod, without affecting Sandbox. This is the narrowest scope that still covers all required resources and avoids repeated subscription-by-subscription administration. Why others are wrong: Per-subscription assignments are valid but operationally inefficient and easy to miss when new subscriptions are added. The Corp management group scope is too broad because it includes Sandbox. A resource-group scope is far too narrow and would require many separate assignments, which defeats the requirement for automatic inheritance.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.