An enterprise has a management group named Corp that contains all production and sandbox subscriptions. An Entra ID group named Auditors must be able to read resources in every current subscription under Corp and in any subscription added later. Which two actions should the administrator take? Select two.

Assign the Reader role directly to every subscription under Corp.

This would work only after every subscription is configured individually. It also creates extra administrative work and does not automatically cover new subscriptions added later.

Assign the Reader role to the Auditors group at one resource group scope.

A resource group assignment is too narrow. It would not grant visibility across all subscriptions under the management group, only that single resource group.

Create an Azure Policy assignment to grant read access to all subscriptions.

Azure Policy evaluates compliance and controls configuration behavior, but it does not grant Azure RBAC permissions or provide read access.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Assign the Reader role to the Auditors group at the Corp management group scope. — The best solution is to assign the Reader role to the Auditors Entra ID group at the Corp management group scope and then place the required users in that group. RBAC assignments at management group scope inherit downward to all child subscriptions and resources, including subscriptions added later. This keeps administration simple and enforces least privilege, because the users receive only read access and only through group membership. Why others are wrong: Assigning permissions at each subscription is brittle and does not cover future subscriptions automatically. A resource group assignment is far too narrow for this requirement. Azure Policy cannot grant RBAC access, so it is not a substitute for a role assignment.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.