A project team expects frequent joiners and leavers. The same Azure permissions are needed for all members of the team, and you want to avoid editing role assignments for each person. Which two actions best meet the requirement? Select two.

Assign the same roles directly to every user account.

Direct user assignments create ongoing administration overhead because every join or leave event requires a manual RBAC change.

Use guest accounts for all team members.

Guest accounts are useful for external collaboration, but they do not by themselves reduce role assignment maintenance for an internal team.

Assign the roles to a service principal shared by the team.

A service principal represents an application, not a changing group of users. It is the wrong identity type for team membership-based access.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Create a security group for the project team. — A security group is the right identity container when many people need the same permissions and membership changes frequently. Assigning the Azure roles to that group means you manage access by changing group membership instead of editing each role assignment individually. This is simpler, more secure, and easier to audit. Why others are wrong: Individual user assignments scale poorly when people join and leave often. Guest accounts are intended for external identities, not as the main solution for internal access management. A service principal is for application authentication, so it does not map to a human team changing over time.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.