AZ-104 Manage Azure Identities and Governance Practice Question
An enterprise uses one management group to contain five subscriptions for a business unit. A compliance auditor in an Entra ID group needs read-only access to every current and future resource in all five subscriptions, but must not see resources in other business units. What is the best scope for the Reader role assignment?
⚠ Common exam trap
Many exam-takers think subscription-level assignments are necessary for granularity, overlooking that management group scope provides inheritance to all current and future subscriptions and resources within that group, which is the most efficient and correct approach for multi-subscription governance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign Reader at the management group that contains the five subscriptions.
Assigning the Reader role at the management group scope grants inherited read-only access to all current and future resources within every subscription under that management group, while preventing access to resources in other business units that are in separate management groups. This satisfies the auditor's requirement for a single, scalable assignment that automatically covers new subscriptions added to the management group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign Reader at the management group that contains the five subscriptions.
Why this is correct
This scope lets the role flow downward to all subscriptions, resource groups, and resources under that management group. It is the narrowest place that still covers every current and future subscription in that business unit. The auditor gets consistent read-only visibility without requiring separate assignments for each subscription, and access stays isolated from other management groups.
- ✗
Assign Reader separately at each subscription in the business unit.
Why it's wrong here
This would provide the needed access, but only after creating and maintaining multiple assignments. It does not take advantage of inheritance from the parent container, so future subscriptions would require manual work. The requirement asks for the best scope, not just a workable one.
When this WOULD be correct
If the requirement was to grant read-only access only to specific existing subscriptions without any future subscriptions, or if the management group was not used and subscriptions were managed independently, then assigning Reader at each subscription would be appropriate.
- ✗
Assign Reader at a single resource group within one subscription.
Why it's wrong here
A resource group scope is too narrow because it only covers resources inside that one group. The auditor would miss resources in other resource groups and other subscriptions. This does not satisfy the need for organization-wide visibility across the business unit.
When this WOULD be correct
This option would be correct if the question required granting read-only access only to resources within a specific resource group, not across multiple subscriptions or management groups.
- ✗
Assign Reader directly to each resource that the auditor should see.
Why it's wrong here
Per-resource assignments are operationally expensive and easy to miss. They do not scale to all current and future resources in five subscriptions. This approach also creates unnecessary administrative overhead compared with inheritance from the management group.
When this WOULD be correct
If the requirement were to grant read-only access only to a specific set of existing resources (e.g., a few VMs) with no need for future resources or subscription-wide access, then assigning Reader at the resource level would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign Reader at the management group that contains the five subscriptions.Correct answer▾
Why this is correct
This scope lets the role flow downward to all subscriptions, resource groups, and resources under that management group. It is the narrowest place that still covers every current and future subscription in that business unit. The auditor gets consistent read-only visibility without requiring separate assignments for each subscription, and access stays isolated from other management groups.
✗Assign Reader separately at each subscription in the business unit.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader at each subscription separately does not cover future resources in new subscriptions added to the management group, violating the requirement for access to all current and future resources.
★ When this WOULD be the correct answer
If the requirement was to grant read-only access only to specific existing subscriptions without any future subscriptions, or if the management group was not used and subscriptions were managed independently, then assigning Reader at each subscription would be appropriate.
Why candidates choose this
Candidates may think that assigning at the subscription level is sufficient and simpler, not realizing that management group assignment provides inheritance to future subscriptions and reduces administrative overhead.
✗Assign Reader at a single resource group within one subscription.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader at a single resource group would not grant access to all resources across five subscriptions, failing the requirement for read-only access to every current and future resource in all five subscriptions.
★ When this WOULD be the correct answer
This option would be correct if the question required granting read-only access only to resources within a specific resource group, not across multiple subscriptions or management groups.
Why candidates choose this
Candidates may think that assigning at a resource group is sufficient because it covers resources within that group, overlooking the need for broader scope across multiple subscriptions.
✗Assign Reader directly to each resource that the auditor should see.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader directly to each resource is impractical and does not scale; it fails to cover future resources and violates the requirement for read-only access to all current and future resources across five subscriptions.
★ When this WOULD be the correct answer
If the requirement were to grant read-only access only to a specific set of existing resources (e.g., a few VMs) with no need for future resources or subscription-wide access, then assigning Reader at the resource level would be appropriate.
Why candidates choose this
Candidates may think that assigning the role directly to each resource provides precise control and ensures the auditor sees only intended resources, overlooking the management group's ability to inherit permissions and cover future resources.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Role assignment
Role assignment is the process of granting a specific set of permissions to a user, group, or service principal so they can perform certain actions within a system.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A cloud operations team in the Corp business unit needs to read all Azure resources in every current and future subscription under the Corp management group to prepare monthly governance reports. They must not gain access to subscriptions that belong to other business units. What scope should the administrator use when assigning the Reader role?
medium- A.Subscription scope
- B.Resource group scope
- ✓ C.Management group scope
- D.Resource scope
Why C: The Reader role assigned at the management group scope grants read-only access to all subscriptions within that management group, including future subscriptions, because Azure RBAC permissions are inherited by child resources. This meets the requirement to cover all current and future subscriptions under the Corp management group while excluding subscriptions in other business units.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.