AZ-104 Manage Azure Identities and Governance Practice Question
An external consultant from another company needs read-only access to a resource group and must sign in with their own work account. What should be created in Microsoft Entra ID?
⚠ Common exam trap
Test-takers frequently confuse a guest user with a member user, thinking a new identity must be created in the tenant, but the key requirement is that the external consultant signs in with their own work account, which only a guest user (B2B collaboration) supports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A guest user account
B is correct because a guest user account in Microsoft Entra ID (formerly Azure AD) allows an external user from another organization to sign in using their own work account (via B2B collaboration) and be granted read-only access to a specific resource group. This leverages the existing identity provider of the external consultant, eliminating the need to create a separate identity in the company tenant.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A member user account in the company tenant
Why it's wrong here
A member user account would incorrectly represent the consultant as an internal employee of your company, with a UserType of 'Member' and full membership in your tenant's directory. Member accounts are designed for your own organization's staff and carry implicit entitlements, such as the ability to be added to all internal groups, access the Azure AD portal, and potentially be subject to different default permissions than guests. Using a member account for an external consultant breaks the security boundary between organizations, complicates audit and lifecycle management, and violates the principle of least privilege because the consultant would be indistinguishable from an employee, making it harder to enforce external collaboration policies.
When this WOULD be correct
If the question asked for granting access to a new employee within the same company who needs read-only access to a resource group, then creating a member user account would be correct.
- ✓
A guest user account
Why this is correct
A guest user account is the correct identity type for an external consultant because it enables Azure AD B2B collaboration: the consultant authenticates against their own home tenant (their company's IdP) and receives a guest identity in your tenant with a UserType of 'Guest'. This allows you to assign read-only access via role assignments like Reader at a specific scope, without creating separate credentials or requiring the consultant to become a member of your organization. Guest user accounts retain their external origin, support conditional access policies that respect the home tenant's MFA, and can be managed through Entra ID, making them the standard, least-privilege mechanism for cross-company collaboration.
- ✗
A Microsoft 365 group
Why it's wrong here
A Microsoft 365 group is a directory object that represents a collection of users or principals, not a standalone principal that can sign in interactively. To grant the consultant read-only access, you would still need a user identity (such as a guest user) to add to the group, and then assign the group a Reader role — but the group itself cannot be the consultant's identity, nor can it authenticate on behalf of a person. Groups are useful for aggregating permissions across multiple members, but they are not a substitute for an individual identity and cannot satisfy the requirement to represent one specific external person who needs to log in and access Azure resources.
When this WOULD be correct
When the question asks for a method to grant a set of external users access to a SharePoint site or Teams channel, and the users need to be managed as a single entity for permissions, creating a Microsoft 365 group and adding them as guests would be correct.
- ✗
A service principal
Why it's wrong here
A service principal is an application identity used for authentication and authorization of automated tools, scripts, or applications via OAuth 2.0 client credentials grants, not for interactive human sign-in. While a service principal could technically be granted Reader permissions, it does not represent a person, cannot use MFA in the same way as a user, and would require managing a secret or certificate, which is insecure for sharing with an external consultant who needs read-only access from their own device. Furthermore, service principals are not tied to an external organization's identity provider, so they would not provide a proper audit trail of the consultant's individual actions, nor would they allow the consultant to authenticate using their corporate credentials — making this option entirely unsuitable for a human collaborator.
When this WOULD be correct
A service principal would be correct if the question asked for an identity to allow an external application (e.g., a script or tool) to access Azure resources without a user signing in, such as for automated backup or monitoring tasks using API authentication.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A guest user accountCorrect answer▾
Why this is correct
A guest user account is the correct identity type for an external consultant because it enables Azure AD B2B collaboration: the consultant authenticates against their own home tenant (their company's IdP) and receives a guest identity in your tenant with a UserType of 'Guest'. This allows you to assign read-only access via role assignments like Reader at a specific scope, without creating separate credentials or requiring the consultant to become a member of your organization. Guest user accounts retain their external origin, support conditional access policies that respect the home tenant's MFA, and can be managed through Entra ID, making them the standard, least-privilege mechanism for cross-company collaboration.
✗A member user account in the company tenantWrong answer — click to see why▾
Why this is wrong here
A member user account is for users within the company's own tenant, not for external consultants who need to sign in with their own work account. Guest user accounts (B2B collaboration) are designed for external users.
★ When this WOULD be the correct answer
If the question asked for granting access to a new employee within the same company who needs read-only access to a resource group, then creating a member user account would be correct.
Why candidates choose this
Candidates may think that any user needing access must be a member of the tenant, not realizing that external users can be added as guests without creating a full member account.
✗A Microsoft 365 groupWrong answer — click to see why▾
Why this is wrong here
A Microsoft 365 group is used for collaboration and granting permissions to multiple users, not for providing external individual access. It cannot be used to give a specific external consultant read-only access to a resource group.
★ When this WOULD be the correct answer
When the question asks for a method to grant a set of external users access to a SharePoint site or Teams channel, and the users need to be managed as a single entity for permissions, creating a Microsoft 365 group and adding them as guests would be correct.
Why candidates choose this
Candidates may confuse Microsoft 365 groups with security groups or think that groups can be used to grant access to Azure resources, but groups are not directly assigned Azure RBAC roles for external users without first creating guest accounts.
✗A service principalWrong answer — click to see why▾
Why this is wrong here
A service principal is an identity for applications or automated tools, not for individual users. The question requires a user account for an external consultant to sign in with their own work account, which is a B2B collaboration scenario, not an application identity.
★ When this WOULD be the correct answer
A service principal would be correct if the question asked for an identity to allow an external application (e.g., a script or tool) to access Azure resources without a user signing in, such as for automated backup or monitoring tasks using API authentication.
Why candidates choose this
Candidates may confuse service principals with user accounts because both can be granted permissions in Azure, but service principals are for non-human identities, leading to a mistake when the scenario clearly involves a human user.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.