AZ-104 Manage Azure Identities and Governance Practice Question
A partner company needs a developer to access resources in your tenant by using the developer's existing work account. You do not want to create a new separate username and password for that person. What should you create in Microsoft Entra ID?
⚠ Common exam trap
Watch out — candidates often confuse a guest user (B2B collaboration) with a service principal or managed identity, thinking any external access requires a non-user identity, but the question explicitly asks for a user account using an existing work account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A guest user account
B is correct because Microsoft Entra ID B2B collaboration allows you to invite an external user's existing work account as a guest user. This grants access to resources without creating a new username and password, as the developer authenticates using their home tenant credentials. Guest users are managed in Entra ID and can be assigned permissions via Azure RBAC or group membership.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A local user account in each resource group
Why it's wrong here
A local user account in each resource group is invalid because resource groups are logical containers within an Azure subscription and do not act as identity stores. User accounts exist only in Microsoft Entra ID (or on-premises directories synchronized to Entra ID), and Azure RBAC assigns permissions to security principals across a management group, subscription, resource group, or resource scope—but the identity itself is always a tenant-level object. There is no concept of a 'local user' defined directly inside a resource group, so this option cannot be implemented or used for authentication.
When this WOULD be correct
This option would be correct if the question asked about granting permissions to a specific resource group for a user who already has an account in the same tenant, and the task was to assign RBAC roles directly to that user at the resource group scope.
- ✓
A guest user account
Why this is correct
A guest user account is the correct identity type for a developer from a partner company because Azure AD B2B collaboration allows you to invite that user into your tenant using their own organization's credentials. This establishes a security principal that can be assigned Azure RBAC roles (e.g., Contributor or Reader) scoped to specific resources or resource groups, while the partner retains control of their password and authentication policies. No new credentials are created in your directory, and the guest can be easily revoked or expired.
- ✗
A managed identity
Why it's wrong here
A managed identity is a Microsoft Entra ID (formerly Azure AD) identity that is automatically managed by Azure and is intended for use by Azure resources—such as a VM, App Service, or Azure Function—to authenticate to other Azure services like Key Vault or Storage. It is not a user identity and cannot be used interactively by a human developer to sign in or perform Azure portal actions. Assigning a managed identity would give the partner's developer no actual login capability, so it cannot satisfy the requirement of 'access resources.'
When this WOULD be correct
A managed identity would be correct if the question asked: 'You need to allow a virtual machine to access Azure Key Vault without storing credentials in code. What should you create?'
- ✗
A new service principal
Why it's wrong here
A new service principal represents an application or automated service in Microsoft Entra ID, not a human user. While you can create a service principal and assign RBAC roles to it, it is designed for non-interactive authentication using client ID and client secret/certificate, typically via the OAuth 2.0 client credentials grant. A partner developer would not use a service principal to sign in interactively to Azure CLI or the portal; it lacks a user profile, MFA context, and interactive login flow. Thus, service principals are the wrong tool for an individual human developer.
When this WOULD be correct
A service principal would be correct if the question asked: 'You need to allow an automated script running in a partner's Azure subscription to access resources in your tenant. What should you create?' In that case, a service principal provides a secure identity for the script without requiring a user account.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A guest user accountCorrect answer▾
Why this is correct
A guest user account is the correct identity type for a developer from a partner company because Azure AD B2B collaboration allows you to invite that user into your tenant using their own organization's credentials. This establishes a security principal that can be assigned Azure RBAC roles (e.g., Contributor or Reader) scoped to specific resources or resource groups, while the partner retains control of their password and authentication policies. No new credentials are created in your directory, and the guest can be easily revoked or expired.
✗A local user account in each resource groupWrong answer — click to see why▾
Why this is wrong here
Local user accounts in resource groups are not supported in Azure; user accounts are managed at the tenant level in Microsoft Entra ID, not per resource group. Creating a local account would also require managing separate credentials, contradicting the requirement to use the developer's existing work account.
★ When this WOULD be the correct answer
This option would be correct if the question asked about granting permissions to a specific resource group for a user who already has an account in the same tenant, and the task was to assign RBAC roles directly to that user at the resource group scope.
Why candidates choose this
Candidates may think that creating a user account within a resource group is a way to provide access without affecting the entire tenant, not realizing that Azure AD user accounts are tenant-wide and resource groups do not have their own user directory.
✗A managed identityWrong answer — click to see why▾
Why this is wrong here
A managed identity is an Azure resource identity used for authenticating to Azure services without storing credentials, not for inviting external users. It cannot be used to grant access to a partner's existing work account.
★ When this WOULD be the correct answer
A managed identity would be correct if the question asked: 'You need to allow a virtual machine to access Azure Key Vault without storing credentials in code. What should you create?'
Why candidates choose this
Candidates may confuse managed identities with guest accounts because both involve identity without password management, but managed identities are for Azure resources, not external users.
✗A new service principalWrong answer — click to see why▾
Why this is wrong here
A service principal is an identity for applications or automated tools, not for individual users. The question requires granting access to a specific developer using their existing work account, which is a user-to-user collaboration scenario, not an application identity scenario.
★ When this WOULD be the correct answer
A service principal would be correct if the question asked: 'You need to allow an automated script running in a partner's Azure subscription to access resources in your tenant. What should you create?' In that case, a service principal provides a secure identity for the script without requiring a user account.
Why candidates choose this
Candidates may confuse service principals with guest users because both involve external access. They might think a service principal is needed for any external identity, overlooking that service principals are for applications, not individual users.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An external consultant must access a resource group in your tenant using the consultant's existing work account. You want to avoid creating a separate username and password pair. Which two actions should the administrator take? Select two.
medium- ✓ A.Invite the consultant as a guest user in Microsoft Entra ID.
- B.Create a new member user account with an internal password.
- ✓ C.Assign the required RBAC role on the target resource group to the guest account.
- D.Add the consultant to the Global Administrator role.
- E.Share the subscription ID and tenant ID only.
Why A: Inviting the consultant as a guest user in Microsoft Entra ID (formerly Azure AD) allows the consultant to use their existing work account (external identity) without creating a new username/password. This leverages B2B collaboration, which uses the consultant's home directory for authentication, and the guest user object is created in your tenant to represent them.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.