Assigning the Reader Role at Management Group Scope for Future-Proof Access
An enterprise has a management group named Corp. Corp contains two child management groups: Prod and Sandbox. A compliance auditor is a member of an Entra ID group and must have read-only access to every current and future resource in all subscriptions that are under Prod. The auditor must not see resources in Sandbox, and the admin does not want to maintain separate assignments for each new subscription. What should the administrator do?
Quick Answer
The answer is to assign the Reader role to the group at the Prod management group scope. This is correct because management groups in Azure form a hierarchy that allows role assignments to be inherited by all child subscriptions and resources, meaning any new subscription added under Prod automatically receives the same read-only permissions without requiring separate assignments. On the AZ-104 exam, this scenario tests your understanding of Azure RBAC inheritance and management group scopes—a common trap is assigning the role at the root management group (Corp), which would grant access to Sandbox as well, or at the subscription level, which would not be future-proof. Remember the key principle: scope inheritance flows downward, so always assign at the highest necessary level that excludes unwanted branches. A useful memory tip is “scope down, lock out”—assign at the management group that covers only the resources you want, and the inheritance chain does the rest.
⚠ Common exam trap
Watch out — candidates often choose Option B (assign at Corp scope) thinking it covers all subscriptions, but they overlook that it would also grant access to Sandbox, failing the requirement to restrict the auditor to Prod only.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the Reader role to the group at the Prod management group scope.
Assigning the Reader role at the Prod management group scope applies that permission to all current and future subscriptions and resources within Prod, satisfying the requirement for read-only access without needing separate assignments. Management groups in Azure provide a hierarchical scope that inherits role assignments to all child subscriptions and resource groups, making this the most efficient and future-proof approach.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the Reader role to the group at each subscription scope under Prod.
Why it's wrong here
This would work for the subscriptions that exist today, but it creates ongoing administrative overhead. Any new subscription added under Prod would need another assignment, so it does not satisfy the requirement to avoid repeated work.
When this WOULD be correct
If the requirement were to grant read-only access only to existing subscriptions under Prod, without needing to cover future subscriptions automatically, then assigning the Reader role at each subscription scope would be appropriate.
- ✗
Assign the Reader role to the group at the Corp management group scope.
Why it's wrong here
That scope is too broad because it would include both Prod and Sandbox. The auditor would gain visibility beyond the requested boundary, which violates the requirement to exclude Sandbox resources.
When this WOULD be correct
This option would be correct if the requirement was to grant read-only access to all current and future resources in all subscriptions under both Prod and Sandbox, without any restriction on Sandbox access.
- ✓
Assign the Reader role to the group at the Prod management group scope.
Why this is correct
A role assignment at the Prod management group scope inherits to all subscriptions, resource groups, and resources beneath that management group, including future subscriptions placed there later. It also stays limited to Prod, so Sandbox remains outside the auditor's visibility.
- ✗
Assign the Reader role to the group at one resource group in each Prod subscription.
Why it's wrong here
A resource-group assignment is too narrow and would miss the rest of each subscription. It also fails the requirement for future subscriptions because each new subscription would require manual assignments to multiple resource groups.
When this WOULD be correct
This option would be correct if the requirement was to grant read-only access only to a specific resource group within each subscription, and the auditor did not need access to other resource groups or future resources outside that group.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign the Reader role to the group at the Prod management group scope.Correct answer▾
Why this is correct
A role assignment at the Prod management group scope inherits to all subscriptions, resource groups, and resources beneath that management group, including future subscriptions placed there later. It also stays limited to Prod, so Sandbox remains outside the auditor's visibility.
✗Assign the Reader role to the group at each subscription scope under Prod.Wrong answer — click to see why▾
Why this is wrong here
Assigning the Reader role at each subscription scope under Prod requires maintaining separate assignments for each new subscription, which contradicts the requirement to avoid manual maintenance.
★ When this WOULD be the correct answer
If the requirement were to grant read-only access only to existing subscriptions under Prod, without needing to cover future subscriptions automatically, then assigning the Reader role at each subscription scope would be appropriate.
Why candidates choose this
Candidates may think that assigning at the subscription level is necessary because they are unaware that management group scope inheritance applies to all child subscriptions, including future ones.
✗Assign the Reader role to the group at the Corp management group scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning the Reader role at the Corp management group scope would grant read-only access to all subscriptions under both Prod and Sandbox, violating the requirement that the auditor must not see resources in Sandbox.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to grant read-only access to all current and future resources in all subscriptions under both Prod and Sandbox, without any restriction on Sandbox access.
Why candidates choose this
Candidates may think that assigning at the highest scope (Corp) is more efficient and covers all subscriptions, overlooking the need to exclude Sandbox as per the requirement.
✗Assign the Reader role to the group at one resource group in each Prod subscription.Wrong answer — click to see why▾
Why this is wrong here
Assigning the Reader role at one resource group in each Prod subscription does not grant access to all current and future resources in the entire subscription, only to that specific resource group. It also requires maintaining separate assignments for each new subscription, violating the requirement to avoid that.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to grant read-only access only to a specific resource group within each subscription, and the auditor did not need access to other resource groups or future resources outside that group.
Why candidates choose this
Candidates might think that assigning at a resource group level is sufficient and simpler, not realizing that management group scope provides inheritance to all subscriptions and resources under it, which is needed for future resources and full subscription coverage.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An enterprise has a management group named Corp that contains all production and sandbox subscriptions. An Entra ID group named Auditors must be able to read resources in every current subscription under Corp and in any subscription added later. Which two actions should the administrator take? Select two.
medium- ✓ A.Assign the Reader role to the Auditors group at the Corp management group scope.
- B.Assign the Reader role directly to every subscription under Corp.
- C.Assign the Reader role to the Auditors group at one resource group scope.
- ✓ D.Add the intended users to the Auditors Entra ID group.
- E.Create an Azure Policy assignment to grant read access to all subscriptions.
Why A: Assigning the Reader role to the Auditors group at the Corp management group scope ensures that the group receives read permissions to all current and future subscriptions and resource groups under Corp, because Azure RBAC permissions assigned at a management group are inherited by all child scopes. This satisfies the requirement for both existing and future subscriptions without manual updates. In addition, the intended users must be added as members of the Auditors Entra ID group, because the role assignment grants permissions to the group, not to individual users. Therefore, both actions are necessary: the role assignment at the correct scope and populating the group with the auditors.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.