AZ-104 Manage Azure Identities and Governance Practice Question
An external consultant must access a resource group in your tenant using the consultant's existing work account. You want to avoid creating a separate username and password pair. Which two actions should the administrator take? Select two.
⚠ Common exam trap
Many candidates confuse inviting a guest user (which uses external authentication) with creating a new user account (which requires a separate password), or they incorrectly think that sharing tenant/subscription IDs alone provides access without an identity and role assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Invite the consultant as a guest user in Microsoft Entra ID.
Inviting the consultant as a guest user in Microsoft Entra ID (formerly Azure AD) allows the consultant to use their existing work account (external identity) without creating a new username/password. This leverages B2B collaboration, which uses the consultant's home directory for authentication, and the guest user object is created in your tenant to represent them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Invite the consultant as a guest user in Microsoft Entra ID.
Why this is correct
Inviting the consultant as a guest user in Microsoft Entra ID (B2B collaboration) creates a user object that references their external identity, so they can authenticate with their existing corporate credentials and benefit from federated SSO. This approach keeps the identity lifecycle in the consultant's home tenant, avoids creating a separate password, and is the mandatory first step for granting any Azure access. Beyond authentication, however, this invitation alone does not grant any permissions.
- ✗
Create a new member user account with an internal password.
Why it's wrong here
Creating a member user account with an internal password forces the consultant to maintain a separate set of credentials that are not tied to their existing work identity, defeating the stated requirement to let them use their own organization's account. Such an account is also a fully managed identity object under your tenant's control, requiring password policies, MFA enrollment, and lifecycle management, and it carries member-level default permissions that are broader than a guest's. Additionally, the account would remain active even after the consultancy ends unless manually removed, creating an orphaned-account security risk.
When this WOULD be correct
If the question stated that the consultant does not have an existing work account that can be used for federation, or if the organization requires internal accounts for all external users, then creating a new member user would be appropriate.
- ✓
Assign the required RBAC role on the target resource group to the guest account.
Why this is correct
While the guest identity provides authentication, Azure RBAC is the authorization mechanism that determines what actions the consultant can take on a specific resource group. Assigning a role like Contributor at the resource group scope grants the necessary control plane permissions while respecting least privilege, because it limits access only to that resource group and its contained resources. Without this assignment, the guest can sign in but will see no resources and receive 'AuthorizationFailed' errors, so both steps are required.
- ✗
Add the consultant to the Global Administrator role.
Why it's wrong here
Placing the consultant in the Global Administrator role would grant them tenant-wide administrative control, far beyond the requested resource group scope, and directly violates the principle of least privilege. Global Administrator is an Entra ID role that allows management of all Azure AD configuration, user accounts, and security settings, and it also confers elevated access to all Azure subscriptions, not just one resource group. Because this role applies to the entire tenant, any compromise of the consultant's credentials could expose the whole organization, making this option both inappropriate and unnecessarily risky.
When this WOULD be correct
If the question required granting the consultant full administrative access across the entire Microsoft Entra ID tenant (e.g., to manage all users and resources), then assigning the Global Administrator role would be correct.
- ✗
Share the subscription ID and tenant ID only.
Why it's wrong here
Subscription IDs and tenant IDs are simply unique identifiers that locate a tenant and subscription; they are not secrets or credentials. Providing them without a guest invitation and RBAC assignment gives the consultant zero ability to authenticate or access any resource, because Azure grants access only to authenticated principals with explicit role assignments. These identifiers might be useful for troubleshooting or for configuring federation, but they have no authorization effect and should never be treated as a way to grant access.
When this WOULD be correct
A question asks how to allow an external user to discover Azure subscription details without granting access, such as for billing or reporting purposes, where the user only needs to know the subscription and tenant IDs to configure tools or scripts.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Invite the consultant as a guest user in Microsoft Entra ID.Correct answer▾
Why this is correct
Inviting the consultant as a guest user in Microsoft Entra ID (B2B collaboration) creates a user object that references their external identity, so they can authenticate with their existing corporate credentials and benefit from federated SSO. This approach keeps the identity lifecycle in the consultant's home tenant, avoids creating a separate password, and is the mandatory first step for granting any Azure access. Beyond authentication, however, this invitation alone does not grant any permissions.
✗Create a new member user account with an internal password.Wrong answer — click to see why▾
Why this is wrong here
Creating a new member user account with an internal password contradicts the requirement to avoid creating a separate username and password pair. The consultant should use their existing work account via B2B collaboration.
★ When this WOULD be the correct answer
If the question stated that the consultant does not have an existing work account that can be used for federation, or if the organization requires internal accounts for all external users, then creating a new member user would be appropriate.
Why candidates choose this
Candidates may think creating a new user is the simplest way to grant access, overlooking the B2B guest invitation feature that allows external users to use their own credentials.
✗Add the consultant to the Global Administrator role.Wrong answer — click to see why▾
Why this is wrong here
Adding the consultant to the Global Administrator role grants tenant-wide administrative privileges, which is excessive and violates the principle of least privilege. The question requires only access to a specific resource group, not full tenant control.
★ When this WOULD be the correct answer
If the question required granting the consultant full administrative access across the entire Microsoft Entra ID tenant (e.g., to manage all users and resources), then assigning the Global Administrator role would be correct.
Why candidates choose this
Candidates may think that giving the highest role ensures the consultant has all necessary permissions, overlooking the specific scope required and the security risk of over-privileging.
✗Share the subscription ID and tenant ID only.Wrong answer — click to see why▾
Why this is wrong here
Sharing only the subscription ID and tenant ID does not grant the consultant any access; they need an identity in the tenant and an RBAC role assignment to access resources.
★ When this WOULD be the correct answer
A question asks how to allow an external user to discover Azure subscription details without granting access, such as for billing or reporting purposes, where the user only needs to know the subscription and tenant IDs to configure tools or scripts.
Why candidates choose this
Candidates may think that providing the subscription and tenant IDs is sufficient for the consultant to authenticate with their own account and gain access, misunderstanding that explicit identity and role assignments are required.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Guest user
A guest user is a temporary or limited-access account that allows someone to use a system, network, or application without full user privileges and often without a permanent identity.
Key term
Tenant
A dedicated and isolated instance of Microsoft Entra ID that an organization receives when signing up for a Microsoft cloud service.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.