AZ-104 Manage Azure Identities and Governance Practice Question
An application team needs Contributor access only for the resources in rg-app. They must not manage any other resources in the subscription. At what scope should you assign the role?
⚠ Common exam trap
A common mix-up: candidates confuse 'resource group scope' with 'subscription scope' and assume Contributor at the subscription level is required for managing a group of resources, not realizing that resource group scope provides the exact isolation needed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Resource group scope
The Contributor role assigned at the resource group scope grants the application team full management access to all resources within rg-app, but no access to resources in other resource groups or at the subscription level. This meets the requirement of restricting permissions to only that specific resource group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Management group scope
Why it's wrong here
A management group scope is a container that holds multiple subscriptions, and role assignments at this level are inherited by every subscription and child management group underneath it. Granting Contributor at the management group scope would therefore provide the application team with write and delete capabilities across a potentially vast set of resources in many different subscriptions, which is far broader than their requirement of contributing only to the application's resource group.
When this WOULD be correct
If the question required granting Contributor access to all resources across multiple subscriptions that belong to the same management group, and the team needed to manage resources in all those subscriptions, then assigning the role at management group scope would be correct.
- ✗
Subscription scope
Why it's wrong here
Subscription scope covers an entire Azure subscription, including all resource groups, resources, and subscription-level configurations such as policies, costs, and resource locks. By assigning Contributor at this scope, the application team would be able to manage every resource within the subscription, even those belonging to other teams or workloads, thereby violating the principle of least privilege and exceeding the stated need for access limited to the application's resource group.
When this WOULD be correct
Assign this role at subscription scope when the requirement is to grant Contributor access to all resources within the entire subscription, without restricting to a specific resource group.
- ✓
Resource group scope
Why this is correct
Assigning the Contributor role at the resource group scope grants the application team full management permissions exclusively over the resources contained within that specific resource group (e.g., rg-app). This scope is the correct boundary because it isolates access to only the resources that make up the application while preventing the team from modifying unrelated resource groups, subscription-wide settings, or resources in other scopes.
- ✗
Resource scope
Why it's wrong here
The resource scope is the most granular level in Azure RBAC, applying a role assignment to a single individual resource such as one virtual machine or one App Service. Selecting this scope would require the administrator to create a separate Contributor assignment for every resource that the application team needs to manage, which is inefficient and error-prone for a multi-resource application; a resource group scope is the appropriate granularity for managing a cohesive set of resources as a single unit.
When this WOULD be correct
A question that asks: 'You need to grant a user Contributor access to a specific virtual machine only, without access to any other resources in the resource group. At what scope should you assign the role?' Then resource scope would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Resource group scopeCorrect answer▾
Why this is correct
Assigning the Contributor role at the resource group scope grants the application team full management permissions exclusively over the resources contained within that specific resource group (e.g., rg-app). This scope is the correct boundary because it isolates access to only the resources that make up the application while preventing the team from modifying unrelated resource groups, subscription-wide settings, or resources in other scopes.
✗Management group scopeWrong answer — click to see why▾
Why this is wrong here
Management group scope applies permissions to all subscriptions within that group, which would grant the team Contributor access to resources beyond rg-app, violating the requirement to restrict access to only that resource group.
★ When this WOULD be the correct answer
If the question required granting Contributor access to all resources across multiple subscriptions that belong to the same management group, and the team needed to manage resources in all those subscriptions, then assigning the role at management group scope would be correct.
Why candidates choose this
Candidates may think management group scope is a way to apply permissions broadly without realizing it encompasses more than the intended resource group, or they may confuse management groups with resource groups.
✗Subscription scopeWrong answer — click to see why▾
Why this is wrong here
Subscription scope grants Contributor access to all resources in the subscription, not just those in rg-app, violating the requirement to restrict access to only that resource group.
★ When this WOULD be the correct answer
Assign this role at subscription scope when the requirement is to grant Contributor access to all resources within the entire subscription, without restricting to a specific resource group.
Why candidates choose this
Candidates may mistakenly think subscription scope is necessary to cover all resources in rg-app, not realizing that resource group scope is sufficient and more restrictive.
✗Resource scopeWrong answer — click to see why▾
Why this is wrong here
Resource scope would grant Contributor access only to a specific resource, not to all resources in rg-app. The requirement is to manage all resources in the resource group, so resource scope is too narrow.
★ When this WOULD be the correct answer
A question that asks: 'You need to grant a user Contributor access to a specific virtual machine only, without access to any other resources in the resource group. At what scope should you assign the role?' Then resource scope would be correct.
Why candidates choose this
Candidates may think that assigning at the resource level is sufficient to cover all resources in the group, but they overlook that each resource requires a separate assignment, and the requirement is for all resources in the group.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
Contributor role
The Contributor role is a built-in Azure role that grants full access to manage resources within a scope but does not allow granting access to other users.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.