AZ-104 Manage Azure Identities and Governance Practice Question
A platform team wants every current and future subscription under the company's Azure hierarchy to inherit Reader access for a central audit group. The team does not want to create separate assignments for each subscription. Where should the role be assigned?
⚠ Common exam trap
It's easy for candidates to think assigning the role at one subscription will propagate to others via inheritance, but Azure RBAC inheritance is strictly hierarchical and does not apply across sibling subscriptions—only downward from a management group or parent scope.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
At the management group that contains the subscriptions.
Assigning the Reader role at the management group level ensures that all current and future subscriptions within that management group inherit the assignment via Azure RBAC inheritance. This meets the requirement without needing separate assignments per subscription, as role assignments flow down the hierarchy from management group to subscription to resource group to resource.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
At the management group that contains the subscriptions.
Why this is correct
Management group scope is designed for governance that must apply across multiple subscriptions, including subscriptions added later under the same hierarchy. A role assignment at that level is inherited by child subscriptions and their resources, which is ideal for broad read-only audit access.
- ✗
At one subscription and rely on inheritance to reach the others.
Why it's wrong here
In Azure RBAC, inheritance flows only downward from management groups to subscriptions, resource groups, and resources within the same hierarchy. A role assignment made at one subscription does not propagate to other subscriptions, even if they are siblings under the same management group, because subscriptions are separate scopes. Relying on this would not only fail to grant access to existing subscriptions, but also to any subscription created in the future unless the assignment is manually duplicated.
When this WOULD be correct
This option would be correct if the question asked for assigning a role to a specific subscription only, without requiring inheritance to other subscriptions, and the audit team only needs access to that one subscription.
- ✗
At a resource group in a single subscription.
Why it's wrong here
A role assignment scoped to a resource group is inherited only by resources within that resource group, not by other resource groups in the same subscription or any resources in other subscriptions. Since the platform team needs read-only audit access across every current and future subscription, this scope will leave the vast majority of the environment uncovered. Moreover, it would require creating a separate assignment in each resource group, which is neither scalable nor centralized.
When this WOULD be correct
This would be correct if the question asked: 'An audit team needs to review resources within a specific resource group across multiple subscriptions, but only for that resource group. Where should Reader access be assigned?'
- ✗
At an individual resource that the audit team will inspect.
Why it's wrong here
Assigning the audit role to an individual resource would restrict access to that one resource only, and even then it would not cover sibling resources in the same resource group. To meet the requirement of every current and future subscription, you would need to place a separate assignment on each and every resource across the entire environment, which is impractical and prone to being missed for newly provisioned resources. This approach also contradicts the principle of least privilege by trying to apply a broad access need at the lowest possible scope, creating a maintenance nightmare instead of a governance solution.
When this WOULD be correct
This would be correct if the question asked: 'An audit team needs to inspect a specific virtual machine and should have read-only access to that VM only, without access to any other resources. Where should the role be assigned?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓At the management group that contains the subscriptions.Correct answer▾
Why this is correct
Management group scope is designed for governance that must apply across multiple subscriptions, including subscriptions added later under the same hierarchy. A role assignment at that level is inherited by child subscriptions and their resources, which is ideal for broad read-only audit access.
✗At one subscription and rely on inheritance to reach the others.Wrong answer — click to see why▾
Why this is wrong here
Role assignments at a single subscription do not inherit to other subscriptions. The question requires a single assignment to cover all current and future subscriptions, which is only possible at the management group level.
★ When this WOULD be the correct answer
This option would be correct if the question asked for assigning a role to a specific subscription only, without requiring inheritance to other subscriptions, and the audit team only needs access to that one subscription.
Why candidates choose this
Candidates may mistakenly believe that Azure RBAC role assignments at one subscription propagate to all subscriptions in the same management group, confusing subscription-level inheritance with management group-level inheritance.
✗At a resource group in a single subscription.Wrong answer — click to see why▾
Why this is wrong here
Assigning at a resource group only grants access to resources within that group, not to all subscriptions under the management group hierarchy. The requirement is for every current and future subscription to inherit Reader access, which requires assignment at a higher scope like a management group.
★ When this WOULD be the correct answer
This would be correct if the question asked: 'An audit team needs to review resources within a specific resource group across multiple subscriptions, but only for that resource group. Where should Reader access be assigned?'
Why candidates choose this
Candidates may think resource groups are the most granular scope that still allows inheritance to multiple resources, but they overlook that inheritance does not span across subscriptions or management groups.
✗At an individual resource that the audit team will inspect.Wrong answer — click to see why▾
Why this is wrong here
Assigning at an individual resource only grants Reader access to that specific resource, not to the entire subscription or management group hierarchy. The question requires inheritance to all current and future subscriptions, which cannot be achieved at the resource level.
★ When this WOULD be the correct answer
This would be correct if the question asked: 'An audit team needs to inspect a specific virtual machine and should have read-only access to that VM only, without access to any other resources. Where should the role be assigned?'
Why candidates choose this
Candidates may think that assigning at a resource is sufficient for the audit team's needs, misunderstanding that the requirement is for all subscriptions, not a single resource.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.