A project team adds and removes contractors every month. The admin wants Azure access to update automatically when membership changes without editing role assignments for each person. Which two actions should the admin take? Select two.

Assign the Azure RBAC role directly to each contractor user account.

Direct user assignments work, but they require repeated updates every time a contractor changes. That creates extra administration and increases the chance of missing someone during a transition.

Create a management group for the contractors.

Management groups organize subscriptions, not individual contractor access. They are useful for governance at a higher level, but they do not solve day-to-day user membership management.

Use a resource lock to control access.

Resource locks protect resources from deletion or modification, but they do not grant or delegate access. Locks are a protection feature, not an identity or authorization feature.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create a Microsoft Entra ID security group for the contractors. — A security group plus a role assignment to that group is the simplest way to manage access for a changing contractor team. The administrator can add or remove people from the group without touching the Azure RBAC assignment itself. This reduces manual work, keeps permissions consistent, and supports least-privilege administration because the same role can be controlled through membership rather than individual user assignments. Why others are wrong: Assigning roles directly to each contractor is harder to maintain and does not scale well. A management group is for organizing subscriptions and governance, not for tracking people. Resource locks are unrelated to permissions and cannot be used to grant access. The goal is to centralize authorization around a group so membership changes automatically affect access.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.