A platform team wants every current and future subscription under the company's Azure hierarchy to inherit Reader access for a central audit group. The team does not want to create separate assignments for each subscription. Where should the role be assigned?

At one subscription and rely on inheritance to reach the others.

RBAC inheritance does not cross from one subscription to unrelated subscriptions. Assigning at one subscription would not reach the others.

At a resource group in a single subscription.

A resource group assignment is limited to that group and its children. It cannot cover every subscription in the organization.

At an individual resource that the audit team will inspect.

A resource-level assignment is far too narrow for an organization-wide audit requirement and would not scale to future subscriptions.

What does this AZ-104 question test?

OSPF neighbours must agree on key parameters.

What is the correct answer to this question?

The correct answer is: At the management group that contains the subscriptions. — Management group scope is the correct choice when access must apply consistently across multiple subscriptions, including subscriptions created later in the same hierarchy. Because RBAC inheritance flows downward from management group to subscription to resource group to resource, one assignment can satisfy the enterprise-wide audit requirement without repetitive configuration. This is a common governance pattern in Azure administration. Why others are wrong: A single subscription cannot extend permissions to other subscriptions. A resource group or resource scope is even narrower and only affects that local area. The requirement explicitly calls for organization-wide coverage and future inheritance, which only management group scope provides.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.