AZ-104 Manage Azure Identities and Governance Practice Question
An administrator added a user to an Entra security group that already has Contributor on a resource group. The role assignment is correct, but the user still gets 'You do not have access' in the Azure portal 5 minutes later. What is the most likely next step?
⚠ Common exam trap
Test-takers frequently assume Azure RBAC changes are instantaneous and overlook the client-side token caching mechanism, leading them to incorrectly modify the role assignment or scope instead of simply refreshing the user's session.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Have the user sign out and sign back in to refresh the access token.
When a user is added to a security group that already has a role assignment, the new permissions take effect immediately in Azure RBAC, but the user's existing access token (which is cached by the Azure portal) does not include the new group membership claims. The token must be refreshed by signing out and signing back in, or by closing and reopening the browser, to force a new token acquisition that includes the updated role assignments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the role assignment from the group to the subscription.
Why it's wrong here
Changing the role assignment from the group to the subscription does not update the user's existing access token, so the immediate symptom—stale group claims—would remain until the token expires. Additionally, this change may inadvertently grant broader access across the entire subscription, violating least-privilege principles and introducing unnecessary security risk. The user would still need to sign out and sign back in for any new assignment to take effect, making this an indirect and potentially harmful workaround rather than a fix.
When this WOULD be correct
If the question stated that the user needs to manage resources across multiple resource groups in the same subscription, and the current role is only assigned at the resource group level, then assigning Contributor at the subscription scope would be correct.
- ✓
Have the user sign out and sign back in to refresh the access token.
Why this is correct
When a user is added to a group that holds a role assignment, the existing access token does not include the new group claim. Entra ID tokens are cached for their lifetime (typically 60-90 minutes), and during that window the Azure portal cannot see the updated membership. Signing out clears the cached token and session state; signing back in forces a fresh token issuance that includes the updated group claims, so RBAC evaluation recognizes the user's new permissions immediately. This is the direct, least-privilege fix.
- ✗
Delete and recreate the resource group.
Why it's wrong here
Deleting and recreating the resource group is destructive and does not affect the user's access token or its claims. The token is issued by Entra ID and is completely independent of the resource group's lifecycle, so the stale group claim would persist even after recreation. Furthermore, recreating a resource group removes all contained resources and role assignments, causing significant downtime and requiring full reconfiguration—none of which resolves the identity/token refresh problem.
When this WOULD be correct
This would be correct if the resource group was corrupted or misconfigured in a way that prevents role assignments from taking effect, and all other troubleshooting steps (like token refresh) have failed. For example, in a scenario where the resource group's metadata is damaged and cannot be repaired.
- ✗
Assign Owner directly to the user.
Why it's wrong here
Directly assigning the Owner role to the user overprivileges them and bypasses the group-based access model entirely. The user would retain permanent Owner rights even after being removed from the security group, creating long-term security and compliance issues. Also, the current access token would not reflect this new direct assignment until refreshed, so it fails to solve the immediate problem; a token refresh is the appropriate low-impact action, not granting excessive elevated privileges.
When this WOULD be correct
In a scenario where a user requires full control over all resources in a subscription, including role assignments, and group-based assignment is not feasible (e.g., the user is an external contractor needing immediate elevated access), assigning Owner directly to the user would be the correct solution.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Have the user sign out and sign back in to refresh the access token.Correct answer▾
Why this is correct
When a user is added to a group that holds a role assignment, the existing access token does not include the new group claim. Entra ID tokens are cached for their lifetime (typically 60-90 minutes), and during that window the Azure portal cannot see the updated membership. Signing out clears the cached token and session state; signing back in forces a fresh token issuance that includes the updated group claims, so RBAC evaluation recognizes the user's new permissions immediately. This is the direct, least-privilege fix.
✗Change the role assignment from the group to the subscription.Wrong answer — click to see why▾
Why this is wrong here
The user already has Contributor permissions via group membership on the resource group; changing the scope to subscription would grant broader access but does not address the token refresh issue causing the 'access denied' message.
★ When this WOULD be the correct answer
If the question stated that the user needs to manage resources across multiple resource groups in the same subscription, and the current role is only assigned at the resource group level, then assigning Contributor at the subscription scope would be correct.
Why candidates choose this
Candidates may think that escalating the role scope (from resource group to subscription) is a quick fix for permission issues, without understanding that the problem is a stale access token, not insufficient permissions.
✗Delete and recreate the resource group.Wrong answer — click to see why▾
Why this is wrong here
Deleting and recreating the resource group would remove all resources and is an extreme, unnecessary action. The issue is a stale access token, not a problem with the resource group itself.
★ When this WOULD be the correct answer
This would be correct if the resource group was corrupted or misconfigured in a way that prevents role assignments from taking effect, and all other troubleshooting steps (like token refresh) have failed. For example, in a scenario where the resource group's metadata is damaged and cannot be repaired.
Why candidates choose this
Candidates might think that recreating the resource group will force a fresh evaluation of permissions, or they may assume the group itself is the cause of the access issue, rather than recognizing the token refresh problem.
✗Assign Owner directly to the user.Wrong answer — click to see why▾
Why this is wrong here
Assigning Owner directly to the user bypasses group-based management and violates the principle of least privilege, but more importantly, it does not address the root cause: the user's access token has not yet been refreshed to include the new group membership.
★ When this WOULD be the correct answer
In a scenario where a user requires full control over all resources in a subscription, including role assignments, and group-based assignment is not feasible (e.g., the user is an external contractor needing immediate elevated access), assigning Owner directly to the user would be the correct solution.
Why candidates choose this
Candidates may think that assigning a higher privilege role like Owner will override any permission issues, or they may assume the Contributor role is insufficient and that Owner is needed to resolve the access problem.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Azure portal
The Azure portal is a web-based, unified console that lets you build, manage, and monitor everything from simple web apps to complex cloud deployments using a graphical user interface.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.