AZ-104 Manage Azure Identities and Governance Practice Question
A project team expects frequent joiners and leavers. The same Azure permissions are needed for all members of the team, and you want to avoid editing role assignments for each person. Which two actions best meet the requirement? Select two.
⚠ Common exam trap
Many exam-takers think assigning roles directly to users (Option C) is simpler, but they overlook the administrative overhead of managing individual assignments for frequent joiners and leavers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a security group for the project team.
Creating a security group allows you to manage permissions collectively rather than individually. By adding or removing users from the group as joiners and leavers occur, you avoid editing role assignments for each person. This aligns with Azure AD group-based licensing and RBAC best practices for dynamic teams.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a security group for the project team.
Why this is correct
Creating a security group for the project team provides a single Azure AD identity object that can be used in role assignments, policy assignments, and conditional access rules. When the team changes, you only update group membership (add/remove users) instead of modifying RBAC assignments, which avoids hitting Azure's role assignment limits and keeps access review simple.
- ✓
Assign the Azure roles to the group instead of individual users.
Why this is correct
Assigning Azure roles to the group rather than to individuals means the role assignment is bound to the group's object ID. As users join or leave the group, their effective permissions change automatically on the next token refresh, so there is no per-user RBAC churn—you manage membership in one place and Azure handles the propagation to the underlying role definitions.
- ✗
Assign the same roles directly to every user account.
Why it's wrong here
Assigning roles directly to each user account creates a one-to-one RBAC assignment for every person, which multiplies administrative effort and becomes error-prone with frequent joiners/leavers. Additionally, every change requires manually adding or removing a role assignment, and you can quickly exceed the subscription's role assignment quota (currently 4,000 per subscription) if the team is large or turnover is high.
When this WOULD be correct
In a scenario where a small, static team has unique permissions per user and no group-based assignment is possible, assigning roles directly to each user account is necessary.
- ✗
Use guest accounts for all team members.
Why it's wrong here
Guest accounts are for inviting external users from other tenants or organizations; they are not the right mechanism for internal team members who already exist in your Azure AD. While you could create guest accounts, they still need individual role assignments (or a group) and they complicate sign-in experiences, licensing, and directory governance without reducing administrative overhead for frequent joiners/leavers.
When this WOULD be correct
A question requiring granting access to external partners or vendors who need temporary, limited access to Azure resources, and you want to manage their identities in your tenant without creating full user accounts.
- ✗
Assign the roles to a service principal shared by the team.
Why it's wrong here
A service principal is an application identity used for automated workloads (e.g., service-to-service authentication) and is not designed to represent a dynamic set of human users. If you assign a team role to a shared service principal, all team members would need to use that same credential to authenticate, which breaks individual accountability, audit trails, and multi-factor authentication—and it is a security anti-pattern for human access.
When this WOULD be correct
If the requirement were to grant permissions to an automated script or application that runs on behalf of the team, and the team members do not need individual identities, then assigning roles to a service principal would be correct. For example, a deployment pipeline that needs access to Azure resources.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a security group for the project team.Correct answer▾
Why this is correct
Creating a security group for the project team provides a single Azure AD identity object that can be used in role assignments, policy assignments, and conditional access rules. When the team changes, you only update group membership (add/remove users) instead of modifying RBAC assignments, which avoids hitting Azure's role assignment limits and keeps access review simple.
✗Assign the same roles directly to every user account.Wrong answer — click to see why▾
Why this is wrong here
Assigning roles directly to each user account requires editing role assignments for every joiner and leaver, which contradicts the requirement to avoid frequent edits.
★ When this WOULD be the correct answer
In a scenario where a small, static team has unique permissions per user and no group-based assignment is possible, assigning roles directly to each user account is necessary.
Why candidates choose this
Candidates may think direct assignment is simpler or more straightforward, not realizing the administrative overhead for frequent changes.
✗Use guest accounts for all team members.Wrong answer — click to see why▾
Why this is wrong here
Guest accounts are for external collaboration, not for managing internal team members. They do not simplify role assignment management for frequent joiners/leavers because each guest still needs individual role assignments or group membership.
★ When this WOULD be the correct answer
A question requiring granting access to external partners or vendors who need temporary, limited access to Azure resources, and you want to manage their identities in your tenant without creating full user accounts.
Why candidates choose this
Candidates may think guest accounts reduce administrative overhead for temporary members, but they overlook that guest accounts still require individual role assignments or group management, and are designed for external users, not internal team churn.
✗Assign the roles to a service principal shared by the team.Wrong answer — click to see why▾
Why this is wrong here
A service principal is an identity for applications or automated tools, not for human users. Assigning roles to a service principal shared by the team would not manage human joiners/leavers and could lead to security risks and lack of auditability.
★ When this WOULD be the correct answer
If the requirement were to grant permissions to an automated script or application that runs on behalf of the team, and the team members do not need individual identities, then assigning roles to a service principal would be correct. For example, a deployment pipeline that needs access to Azure resources.
Why candidates choose this
Candidates may confuse service principals with security groups, thinking both can be used to group permissions. They might also believe that a shared identity simplifies management, overlooking that service principals are not designed for human user management.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Security group
A security group is a virtual firewall that controls inbound and outbound traffic to AWS resources, such as EC2 instances, based on defined rules.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, which identity should be granted the Contributor role so access can be managed centrally as team members change?
medium- A.Assign Contributor to each user account individually.
- ✓ B.Assign Contributor to a Microsoft Entra security group that contains the team members.
- C.Assign Contributor to a managed identity.
- D.Assign Contributor to the management group that contains rg-app.
Why B: Assigning the Contributor role to a Microsoft Entra security group that contains the team members allows access to be managed centrally. As team members join or leave, you simply add or remove them from the group, and their permissions update automatically without needing to modify role assignments for each individual user. This aligns with Azure RBAC best practices for centralized identity governance.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.