An enterprise uses one management group to contain five subscriptions for a business unit. A compliance auditor in an Entra ID group needs read-only access to every current and future resource in all five subscriptions, but must not see resources in other business units. What is the best scope for the Reader role assignment?

Assign Reader separately at each subscription in the business unit.

This would provide the needed access, but only after creating and maintaining multiple assignments. It does not take advantage of inheritance from the parent container, so future subscriptions would require manual work. The requirement asks for the best scope, not just a workable one.

Assign Reader at a single resource group within one subscription.

A resource group scope is too narrow because it only covers resources inside that one group. The auditor would miss resources in other resource groups and other subscriptions. This does not satisfy the need for organization-wide visibility across the business unit.

Assign Reader directly to each resource that the auditor should see.

Per-resource assignments are operationally expensive and easy to miss. They do not scale to all current and future resources in five subscriptions. This approach also creates unnecessary administrative overhead compared with inheritance from the management group.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Assign Reader at the management group that contains the five subscriptions. — RBAC assignments inherit downward through the Azure hierarchy, from management group to subscription, resource group, and resource. Assigning Reader at the management group that contains the five subscriptions gives the auditor read-only access to everything in that branch, including resources created later. It also keeps access limited to that business unit instead of granting visibility across unrelated subscriptions. Why others are wrong: Subscription-level assignments would work only if repeated across all five subscriptions and updated for every future one. A resource group or resource-level assignment is far too narrow and would miss many assets. The management group is the correct scope because it is the first place that covers all five subscriptions through inheritance.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.