A project team adds and removes contractors every month. The team wants Azure role assignments to stay the same when individual contractors leave or join, and access should be granted to everyone on the team through one control point. What should the administrator assign the Azure role to?

A Microsoft 365 group

Microsoft 365 groups are optimized for collaboration services, but they are not the best default choice for RBAC delegation.

A guest user account

A guest user represents one external person, so it does not simplify access for a changing team membership.

A managed identity

Managed identities are for Azure resources and automation, not for grouping human users for role delegation.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: A Microsoft Entra security group — Assigning the role to a Microsoft Entra security group lets the administrator manage access by changing group membership instead of repeatedly modifying Azure role assignments. That pattern is ideal for contractor or project teams because the permission target remains stable while people join or leave. It also supports least privilege when the same access must be shared by several users. In Azure, RBAC permissions can be assigned directly to groups, making administration simpler and less error-prone. Why others are wrong: A Microsoft 365 group is mainly intended for collaboration workloads and is not the best general-purpose RBAC delegation object. A guest user account represents only one external identity, so it does not scale for a team. A managed identity is tied to an Azure resource or workload, not a set of human administrators. None of those options provides the clean membership-based access control the scenario requires.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.