A project team has 12 operators who need to read resource properties and restart only the virtual machines in one application resource group. Access should be removed automatically when an operator leaves the team, and any new VMs added to that resource group should inherit the same access without further changes. What should the administrator configure?

Assign the role directly to each operator at the resource group scope.

Direct user assignments do not meet the requirement for automatic removal through group membership changes. They also create extra administration work whenever the team changes.

Assign Virtual Machine Contributor to the team at the subscription scope.

This is too broad because it grants more VM management capabilities than the requirement calls for and applies across the entire subscription instead of one resource group.

Use a resource lock and add the operators as lock owners.

Locks are not an access-management mechanism. They do not grant read or restart permissions and do not integrate with group membership the way RBAC does.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create an Entra ID group, add the operators to it, and assign a custom least-privilege role to the group at the resource group scope. — The requirement combines least privilege, automatic access removal, and inheritance to future resources. An Entra ID group provides clean membership-based administration, a custom role keeps the permissions limited to only what the operators need, and the resource-group scope ensures all VMs in that group inherit the assignment now and in the future. Why others are wrong: Direct assignments create manual cleanup and do not scale with staffing changes. Virtual Machine Contributor is broader than necessary and also applies to the whole subscription. Locks protect resources from modification or deletion, but they do not grant operational access to users or groups.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.