AZ-104 Manage Azure Identities and Governance Practice Question
A project team has 12 operators who need to read resource properties and restart only the virtual machines in one application resource group. Access should be removed automatically when an operator leaves the team, and any new VMs added to that resource group should inherit the same access without further changes. What should the administrator configure?
⚠ Common exam trap
It's easy for candidates to confuse resource locks with RBAC permissions, thinking locks can control access, or they overlook the need for a group-based approach to meet the automatic access removal requirement, instead choosing direct assignments or overly broad subscription-level roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Entra ID group, add the operators to it, and assign a custom least-privilege role to the group at the resource group scope.
It uses an Entra ID group to manage access, which allows automatic removal of operators from the group when they leave the team, and any new VMs added to the resource group will inherit the role assignment at the resource group scope. A custom least-privilege role ensures operators can only read resource properties and restart VMs, meeting the specific requirements without over-permissioning.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the role directly to each operator at the resource group scope.
Why it's wrong here
Assigning the role to each user's Entra ID object individually is functionally valid RBAC, but it fails the efficiency and lifecycle requirement. Every membership change (hire, transfer, departure) becomes a manual task: an admin must locate and delete each stale assignment, and forgetting one leaves an ex-employee with access. Group-based assignment, by contrast, binds permissions to membership, so removing a user from the group revokes their assignments automatically. This option also multiplies administrative overhead and does not leverage Entra ID group management.
When this WOULD be correct
If the question stated that the team is small and static (no turnover) and the resource group will not change, direct assignment would be simpler and still meet the requirements.
- ✓
Create an Entra ID group, add the operators to it, and assign a custom least-privilege role to the group at the resource group scope.
Why this is correct
Using a group makes access management dynamic, because removing someone from the group immediately removes their effective permissions. Assigning the role at the resource group scope also ensures any new VM in that group inherits the access automatically, while a custom role can keep permissions limited to read and restart actions.
- ✗
Assign Virtual Machine Contributor to the team at the subscription scope.
Why it's wrong here
Virtual Machine Contributor is a built-in role that grants create, delete, start, stop, and extension management permissions—far more than the read and restart the operators need. Applying it at subscription scope extends that excess across every resource group and resource in the subscription, violating least privilege and expanding blast radius. Even if the team were a group, the combination of a broad role and top-level scope fails the requirements stated in the scenario.
When this WOULD be correct
This option would be correct if the requirement was for a team to manage all virtual machines across the entire subscription (e.g., a central IT team responsible for all VMs), and the question did not specify automatic access removal or inheritance to new resources. In that case, assigning Virtual Machine Contributor at subscription scope would be appropriate.
- ✗
Use a resource lock and add the operators as lock owners.
Why it's wrong here
A resource lock is an Azure management control that protects resources from deletion or modification—it does not authorize anyone to perform actions. The ReadOnly lock mode would actually block restart operations because restart submits a write request to the VM, so operators could not do their job. Stakeholders cannot be given permission by being lock owners; locks have no concept of ownership for access purposes, and lock assignments do not sync with Entra ID group membership. This option confuses protection with authorization.
When this WOULD be correct
An administrator needs to prevent accidental deletion of a critical resource group while allowing a specific team to manage resources within it. The team already has the necessary RBAC role, and a resource lock is added to protect the resource group from deletion.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create an Entra ID group, add the operators to it, and assign a custom least-privilege role to the group at the resource group scope.Correct answer▾
Why this is correct
Using a group makes access management dynamic, because removing someone from the group immediately removes their effective permissions. Assigning the role at the resource group scope also ensures any new VM in that group inherits the access automatically, while a custom role can keep permissions limited to read and restart actions.
✗Assign the role directly to each operator at the resource group scope.Wrong answer — click to see why▾
Why this is wrong here
Direct role assignment per operator requires manual updates when operators leave or new VMs are added, failing the automatic access removal and inheritance requirements.
★ When this WOULD be the correct answer
If the question stated that the team is small and static (no turnover) and the resource group will not change, direct assignment would be simpler and still meet the requirements.
Why candidates choose this
Candidates may think direct assignment is straightforward and sufficient, overlooking the need for automatic access management and inheritance for new resources.
✗Assign Virtual Machine Contributor to the team at the subscription scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning Virtual Machine Contributor at the subscription scope grants excessive permissions (e.g., ability to manage all VMs across all resource groups) and does not restrict access to only reading properties and restarting VMs in one resource group. It also does not automatically remove access when an operator leaves, as the role is assigned directly to the team rather than through a group.
★ When this WOULD be the correct answer
This option would be correct if the requirement was for a team to manage all virtual machines across the entire subscription (e.g., a central IT team responsible for all VMs), and the question did not specify automatic access removal or inheritance to new resources. In that case, assigning Virtual Machine Contributor at subscription scope would be appropriate.
Why candidates choose this
Candidates may think Virtual Machine Contributor is a standard role that covers the required actions (read and restart VMs) and assume assigning it at subscription scope is simpler, overlooking the need for least privilege and automatic access management via groups.
✗Use a resource lock and add the operators as lock owners.Wrong answer — click to see why▾
Why this is wrong here
Resource locks prevent accidental deletion or modification of resources but do not grant access permissions; they cannot provide the read and restart permissions required for the operators.
★ When this WOULD be the correct answer
An administrator needs to prevent accidental deletion of a critical resource group while allowing a specific team to manage resources within it. The team already has the necessary RBAC role, and a resource lock is added to protect the resource group from deletion.
Why candidates choose this
Candidates may confuse resource locks with access control, thinking that locking a resource and adding users as lock owners grants them permissions, but locks only protect against operations, not grant access.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID Users and Groups
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
Role assignment
Role assignment is the process of granting a specific set of permissions to a user, group, or service principal so they can perform certain actions within a system.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.