AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Reader, because it is the most restrictive role available.

  Why it's wrong here

  Reader is the most restrictive built-in role, but it is too restrictive for this task because it only grants read permissions to resources and does not include any Microsoft.Authorization actions. Without Microsoft.Authorization/roleAssignments/write, the security team cannot create new role assignments, and without the delete counterpart they cannot remove existing ones. Moreover, a Reader cannot even modify its own role assignment to gain more permissions, because the write action is not allowed. Delegating access management requires a role that includes authorization-write capabilities, which Reader explicitly lacks.

  When this WOULD be correct

  A question where the requirement is to allow operators to view resources and their configurations in a resource group without making any changes, and no role management is needed.

• ✗

  Contributor, because it can manage resources and role assignments together.

  Why it's wrong here

  Contributor has full management permissions over all resources in the resource group, including the ability to create, modify, and delete resources, but it deliberately excludes the Microsoft.Authorization/* operations. This means Contributor cannot assign or remove RBAC role assignments, so the security team would still be unable to perform the required access changes. In addition, assigning Contributor would provide far broader rights than needed, allowing the team to directly manipulate workloads—a clear violation of least privilege. To delegate only access administration, you need a role that includes Microsoft.Authorization/roleAssignments/write without the broader resource-management actions.

  When this WOULD be correct

  A question where operators need to manage resources (create, modify, delete) but not manage access, and the scope is a resource group. For example: 'Which role allows a team to deploy and manage VMs and storage accounts in a resource group?'

• ✓

  User Access Administrator at the resource group scope.

  Why this is correct

  User Access Administrator is the built-in role designed for managing access permissions without granting broad resource management rights. At the resource group scope, it lets the security team add and remove RBAC assignments for that group while avoiding direct control over the workload resources themselves. This matches least privilege much better than Owner or Contributor.

• ✗

  Tag Contributor, because role management and tagging are both governance tasks.

  Why it's wrong here

  Tag Contributor is a built-in Azure role that only grants permission to read resources and modify resource tags. It does not include the Microsoft.Authorization/roleAssignments/write action, which is required to create role assignments, nor does it include delete permissions necessary to remove access. Tagging and RBAC administration are separate control-plane operations; having a governance-focused role does not imply the ability to delegate other governance-related permissions. Therefore, the security team could only change metadata, not manage who has access.

  When this WOULD be correct

  A question that asks which role allows operators to manage resource tags (e.g., add, modify, or delete tags) but not create, modify, or delete the resources themselves. The Tag Contributor role would be correct for that scenario.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question