AZ-104 Manage Azure Identities and Governance Practice Question
A project team adds and removes contractors every month. The admin wants Azure access to update automatically when membership changes without editing role assignments for each person. Which two actions should the admin take? Select two.
⚠ Common exam trap
Watch out — candidates often confuse management groups (Option D) with security groups, thinking they can be used for access control, but management groups are for organizing subscriptions and applying policies, not for assigning RBAC roles to users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Microsoft Entra ID security group for the contractors.
Creating a Microsoft Entra ID security group for contractors allows the admin to manage membership dynamically. When contractors are added or removed from the group, their Azure access updates automatically without needing to edit individual role assignments. This leverages group-based RBAC, where the group is assigned the role, and membership changes propagate to Azure RBAC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Microsoft Entra ID security group for the contractors.
Why this is correct
A security group gives the administrator one place to manage a changing set of users. When contractors join or leave, membership can be updated without rewriting Azure role assignments. This is the standard way to delegate access for a team or project that changes often.
- ✗
Assign the Azure RBAC role directly to each contractor user account.
Why it's wrong here
Assigning the Azure RBAC role directly to each contractor user account is technically functional, but it forces an administrator to edit the role assignment every time a contractor joins or leaves the project. This is error-prone because a departed contractor's role assignment can easily be forgotten, leaving them with lingering access to production resources — a significant security risk. It also multiplies the number of role assignments, making an audit of effective permissions more complex, whereas group-based assignments centralize the control.
When this WOULD be correct
If the question stated that the team has a small, stable set of contractors who rarely change, and the admin needs to assign unique permissions per individual, then direct role assignment would be appropriate.
- ✓
Assign the Azure RBAC role to the security group.
Why this is correct
Assigning the Azure RBAC role to a security group creates a single, stable role assignment that remains untouched as contractor membership fluctuates. When a contractor is added to or removed from the group, their effective permissions change automatically without any direct modification to the role assignment on the resource. This pattern follows the least-privilege principle and ensures that the role's scope — whether subscription, resource group, or individual resource — is consistently applied to the entire group.
- ✗
Create a management group for the contractors.
Why it's wrong here
A management group is an Azure hierarchy container used to organize subscriptions and apply governance policies, not a container for user identities. Contractors cannot be added as members of a management group; only Azure subscriptions and other management groups can be placed inside this hierarchy. While management groups can inherit RBAC role assignments for the subscriptions beneath them, they do not simplify the per-user membership churn of a project team, because they operate at the subscription/organizational level rather than the individual account level.
When this WOULD be correct
An organization needs to apply consistent Azure Policy or RBAC across multiple subscriptions. The admin should create a management group, place the subscriptions under it, and assign the policy or role at the management group level.
- ✗
Use a resource lock to control access.
Why it's wrong here
Resource locks, such as CanNotDelete or ReadOnly, are applied to a resource or resource group to prevent accidental deletion or modification by any user, including an administrator. They are an authorization control that overrides RBAC, but they do not grant or delegate access to anyone; in fact, they restrict all operations uniformly. Using a lock would not help onboard contractors — it would prevent them from making any changes, making the resource unusable for the project, and it has nothing to do with identity membership.
When this WOULD be correct
An admin needs to prevent accidental deletion of a critical production resource. The correct action would be to apply a resource lock (e.g., CanNotDelete) to that resource, ensuring no one, even with high privileges, can delete it without removing the lock first.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a Microsoft Entra ID security group for the contractors.Correct answer▾
Why this is correct
A security group gives the administrator one place to manage a changing set of users. When contractors join or leave, membership can be updated without rewriting Azure role assignments. This is the standard way to delegate access for a team or project that changes often.
✗Assign the Azure RBAC role directly to each contractor user account.Wrong answer — click to see why▾
Why this is wrong here
Assigning RBAC roles directly to each contractor user account requires manual updates when contractors change, which does not meet the requirement for automatic access updates based on membership changes.
★ When this WOULD be the correct answer
If the question stated that the team has a small, stable set of contractors who rarely change, and the admin needs to assign unique permissions per individual, then direct role assignment would be appropriate.
Why candidates choose this
Candidates may think direct assignment is simpler or more direct, not realizing it creates administrative overhead for frequent membership changes.
✗Create a management group for the contractors.Wrong answer — click to see why▾
Why this is wrong here
Management groups are used for organizing subscriptions and applying governance policies, not for managing user access to resources. They do not support direct role assignments for user access control.
★ When this WOULD be the correct answer
An organization needs to apply consistent Azure Policy or RBAC across multiple subscriptions. The admin should create a management group, place the subscriptions under it, and assign the policy or role at the management group level.
Why candidates choose this
Candidates may confuse management groups with security groups, thinking both are used for grouping entities for access control, but management groups are for subscription organization, not user permissions.
✗Use a resource lock to control access.Wrong answer — click to see why▾
Why this is wrong here
Resource locks prevent accidental deletion or modification of resources, but they do not automate role assignment updates based on group membership changes. The question requires dynamic access updates, which resource locks cannot provide.
★ When this WOULD be the correct answer
An admin needs to prevent accidental deletion of a critical production resource. The correct action would be to apply a resource lock (e.g., CanNotDelete) to that resource, ensuring no one, even with high privileges, can delete it without removing the lock first.
Why candidates choose this
Candidates may confuse resource locks with access control mechanisms, thinking they can restrict access similarly to RBAC, or they may misread the question as needing to protect resources rather than automate access updates.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Security group
A security group is a virtual firewall that controls inbound and outbound traffic to AWS resources, such as EC2 instances, based on defined rules.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.