AZ-104 Manage Azure Identities and Governance Practice Question
A project team adds and removes contractors every few weeks. The team needs Azure access to follow membership changes without updating role assignments for each person. What should the administrator use to delegate the access?
⚠ Common exam trap
The trap here is that candidates might confuse Microsoft 365 groups (which are primarily for collaboration and may not support all Azure RBAC roles) with security groups, or incorrectly think that management groups are appropriate for individual user access delegation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Microsoft Entra security group, add the contractors, and assign the Azure role to the group.
Assigning an Azure role to a Microsoft Entra security group allows the administrator to manage access by simply adding or removing contractors from the group, without needing to update role assignments for each individual. This leverages Azure RBAC's support for group-based assignments, which automatically propagate role permissions to new members and revoke them from removed members.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the Azure role directly to each contractor user account.
Why it's wrong here
Directly assigning an Azure role to each contractor user account is technically functional, but it forces an RBAC assignment edit for every single membership change. This creates a repetitive administrative burden, increases the chance of accidentally leaving orphaned permissions when contractors leave, and makes it easy to lose track of who currently holds access. Role assignments are also not dynamic by default, so each new contractor requires a manual add and each departing contractor requires a manual removal, which is exactly the kind of overhead that a security group avoids by centralizing membership management.
When this WOULD be correct
If the question specified that contractors are permanent employees with stable membership and the requirement is to grant individual permissions for audit purposes, directly assigning roles to user accounts would be correct.
- ✓
Create a Microsoft Entra security group, add the contractors, and assign the Azure role to the group.
Why this is correct
A security group is the best delegation target because membership can change without editing the RBAC assignment. The role remains stable, while adding or removing users from the group immediately changes who receives the permissions. This is the standard least-administration approach for a team whose membership changes often.
- ✗
Use a Microsoft 365 group and assign the Azure role to it.
Why it's wrong here
Microsoft 365 groups cannot be assigned Azure roles directly, making this option unsuitable for delegating Azure resource access. Azure Role-Based Access Control (RBAC) requires a security principal, such as a security group or a role-assignable group in Microsoft Entra ID, to hold the role assignment. This option is tempting because Microsoft 365 groups simplify membership management for collaboration services like SharePoint or Teams, where they *are* the appropriate mechanism for controlling access based on team membership.
When this WOULD be correct
If the question asked about delegating access to Microsoft 365 resources (e.g., SharePoint, Exchange) or assigning Microsoft Entra roles (like Global Administrator), a Microsoft 365 group could be used via role-assignable groups.
- ✗
Create a management group for the contractors and assign the role there.
Why it's wrong here
Management groups are subscription-organizing containers, not security principals. They exist to aggregate Azure subscriptions for policy, cost, and compliance governance, and cannot directly hold user accounts as members. Assigning a role at the management group scope grants permissions across every subscription within that hierarchy, so contractors would receive far broader access than intended, and you still cannot manage individual contractor membership through the management group itself. This makes it unsuitable for representing a temporary project team whose members change frequently.
When this WOULD be correct
An administrator needs to apply the same Azure role to all subscriptions within a department for compliance purposes, and the role should automatically apply to new subscriptions added to the management group. The question would specify that access must be inherited across multiple subscriptions without per-subscription assignment.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a Microsoft Entra security group, add the contractors, and assign the Azure role to the group.Correct answer▾
Why this is correct
A security group is the best delegation target because membership can change without editing the RBAC assignment. The role remains stable, while adding or removing users from the group immediately changes who receives the permissions. This is the standard least-administration approach for a team whose membership changes often.
✗Assign the Azure role directly to each contractor user account.Wrong answer — click to see why▾
Why this is wrong here
Assigning roles directly to each contractor requires updating role assignments every time contractors change, which does not meet the requirement to follow membership changes without updating role assignments.
★ When this WOULD be the correct answer
If the question specified that contractors are permanent employees with stable membership and the requirement is to grant individual permissions for audit purposes, directly assigning roles to user accounts would be correct.
Why candidates choose this
Candidates may think direct assignment is simpler or more straightforward, not realizing the administrative overhead of managing frequent changes.
✗Use a Microsoft 365 group and assign the Azure role to it.Wrong answer — click to see why▾
Why this is wrong here
Microsoft 365 groups do not support Azure role assignments; only Microsoft Entra ID security groups and Microsoft Entra ID role-assignable groups can be used for Azure RBAC.
★ When this WOULD be the correct answer
If the question asked about delegating access to Microsoft 365 resources (e.g., SharePoint, Exchange) or assigning Microsoft Entra roles (like Global Administrator), a Microsoft 365 group could be used via role-assignable groups.
Why candidates choose this
Candidates may confuse Microsoft 365 groups with security groups, assuming all group types support Azure RBAC, or they may think Microsoft 365 groups are the same as Entra ID groups.
✗Create a management group for the contractors and assign the role there.Wrong answer — click to see why▾
Why this is wrong here
Management groups are used to organize subscriptions and apply governance at scale, not to manage access for individual users or groups. Assigning a role to a management group would grant access to all subscriptions under it, which is too broad and does not solve the need to dynamically add/remove contractors without updating role assignments.
★ When this WOULD be the correct answer
An administrator needs to apply the same Azure role to all subscriptions within a department for compliance purposes, and the role should automatically apply to new subscriptions added to the management group. The question would specify that access must be inherited across multiple subscriptions without per-subscription assignment.
Why candidates choose this
Candidates may confuse management groups with security groups, thinking that management groups can be used to manage user access similarly, or they may overestimate the granularity of management groups for user-level permissions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.