AZ-104 Manage Azure Identities and Governance Practice Question
A service desk must grant and revoke access to an internal application for a changing group of employees. The service desk must not receive any Azure subscription or resource permissions. Which two actions should you take? Select two.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Microsoft Entra security group to represent application access.
Using a Microsoft Entra security group creates a stable access boundary for the application, and making the service desk an owner lets them add or remove members without touching Azure RBAC. That is the least-privilege way to delegate access administration. It keeps resource permissions out of the model, avoids tenant-wide admin roles, and supports frequent employee changes cleanly through group membership updates. Why others are wrong: Contributor on a resource group gives Azure resource control, not just membership administration. User Administrator is a directory-wide role and is too broad for one application group. Individual user assignments defeat the goal of delegated membership management and create ongoing maintenance. The correct pattern is group-based access with delegated ownership.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a Microsoft Entra security group to represent application access.
Why this is correct
A Microsoft Entra security group acts as a logical container for application access: once the group is assigned to an enterprise application's Users and groups tab, every member automatically receives the application role, and membership changes take effect at the next provisioning cycle or token refresh. This approach centralizes access policy and lets you use both static and dynamic membership rules, making revocation as simple as removing a user from the group rather than editing application assignments individually.
- ✓
Add the service desk as an owner of that security group.
Why this is correct
Adding the service desk as an Owner of the security group delegates only membership management for that specific group, not any Azure resource permissions or tenant-wide directory roles. Group owners can add or remove members through the Entra admin center, PowerShell, or Microsoft Graph, and their scope is limited by the group's lifecycle. This honors least privilege because ownership of the group does not automatically grant the service desk access to the application itself.
- ✗
Assign the service desk the Contributor role on the application resource group.
Why it's wrong here
The Contributor role on the application resource group grants Azure RBAC rights to manage resources such as VMs, app services, and databases, but it has no authority over Microsoft Entra ID application assignments or group memberships. Giving the service desk Contributor would allow them to modify or delete Azure resources and create role assignments, which is far more privilege than needed for granting or revoking application access. This directly contradicts the requirement to avoid subscription or resource-level access.
When this WOULD be correct
In a scenario where the service desk needs to manage Azure resources (e.g., virtual machines or web apps) for an application, and the requirement does not prohibit granting Azure permissions, assigning the Contributor role on the resource group would be appropriate.
- ✗
Assign the service desk the User Administrator directory role to manage the application users.
Why it's wrong here
User Administrator is a Microsoft Entra ID directory role that can manage users and groups across the entire tenant, including resetting passwords and managing user attributes, but it does not specifically grant the ability to assign users to an enterprise application. To manage application assignments with this role, the user would also need other permissions, and the blast radius of a compromised help desk account would be enormous. Assigning such a broad role violates least privilege when a scoped group-owner role is sufficient.
When this WOULD be correct
If the question required the service desk to manage user accounts (e.g., create, delete, reset passwords) for the application's users, and the service desk needed directory-level permissions without resource-level access, then assigning the User Administrator role would be correct.
- ✗
Create individual user assignments for every employee instead of using group-based access.
Why it's wrong here
Creating individual user assignments for each employee means the service desk must maintain a separate assignment object per user in the enterprise application, which does not scale and is prone to orphaned permissions when employees transfer or leave. Unlike group-based assignment, direct user assignments cannot leverage dynamic membership or delegated ownership, so the service desk would need a broader role such as Application Administrator to edit assignments. This creates unnecessary administrative overhead and violates the goal of a maintainable access model.
When this WOULD be correct
If the application does not support group-based claims or if the requirement is to assign specific permissions per user that cannot be uniformly applied via a group, individual assignments would be necessary.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use a Microsoft Entra security group to represent application access.Correct answer▾
Why this is correct
A Microsoft Entra security group acts as a logical container for application access: once the group is assigned to an enterprise application's Users and groups tab, every member automatically receives the application role, and membership changes take effect at the next provisioning cycle or token refresh. This approach centralizes access policy and lets you use both static and dynamic membership rules, making revocation as simple as removing a user from the group rather than editing application assignments individually.
✗Assign the service desk the Contributor role on the application resource group.Wrong answer — click to see why▾
Why this is wrong here
Assigning the Contributor role on the application resource group grants the service desk permissions to manage Azure resources, violating the requirement that they must not receive any Azure subscription or resource permissions.
★ When this WOULD be the correct answer
In a scenario where the service desk needs to manage Azure resources (e.g., virtual machines or web apps) for an application, and the requirement does not prohibit granting Azure permissions, assigning the Contributor role on the resource group would be appropriate.
Why candidates choose this
Candidates may think the Contributor role is necessary for the service desk to manage application access, but they overlook the explicit constraint that the service desk must not have Azure resource permissions.
✗Assign the service desk the User Administrator directory role to manage the application users.Wrong answer — click to see why▾
Why this is wrong here
The User Administrator role grants permissions to manage all users in the directory, including resetting passwords and managing licenses, which exceeds the requirement that the service desk must not receive any Azure subscription or resource permissions. The question specifically asks for granting/revoking access to an internal application, not managing user accounts.
★ When this WOULD be the correct answer
If the question required the service desk to manage user accounts (e.g., create, delete, reset passwords) for the application's users, and the service desk needed directory-level permissions without resource-level access, then assigning the User Administrator role would be correct.
Why candidates choose this
Candidates may confuse managing application access with managing user accounts, thinking that the User Administrator role is needed to add/remove users from the application, when in fact group membership management is sufficient.
✗Create individual user assignments for every employee instead of using group-based access.Wrong answer — click to see why▾
Why this is wrong here
Creating individual user assignments for every employee is inefficient for a changing group; it requires manual updates for each user addition or removal, contradicting the need for a scalable, group-based approach.
★ When this WOULD be the correct answer
If the application does not support group-based claims or if the requirement is to assign specific permissions per user that cannot be uniformly applied via a group, individual assignments would be necessary.
Why candidates choose this
Candidates may think individual assignments offer finer control or are simpler to implement, overlooking the administrative overhead and the question's emphasis on a changing group.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Azure resource
An Azure resource is a manageable item available through Microsoft Azure, such as a virtual machine, database, or web app.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.