Assign Reader Role at Management Group Scope
Exhibit
Management group hierarchy: Corp ├─ Sub-Prod-01 │ └─ RG-Finance └─ Sub-Prod-02 └─ RG-Shared Current role assignment: - Reader assigned to Entra ID group Auditors at scope: /providers/Microsoft.Management/managementGroups/Corp Requirement: - Members of Auditors must read resources in any new subscription added under Corp without adding another assignment.
Based on the exhibit, a compliance team must read all current and future resources in every subscription under the Corp management group. Where should you assign the Reader role?
Quick Answer
The answer is to assign the Reader role at the Corp management group scope. This is correct because Azure RBAC roles assigned at a management group scope are inherited by all child management groups, subscriptions, and resource groups within that hierarchy, ensuring the compliance team can read all current and future resources without needing separate assignments. On the AZ-104 exam, this scenario tests your understanding of scope inheritance and the principle of least privilege, often appearing as a trap where candidates mistakenly assign the role at a subscription or resource group level instead of the parent management group. A common memory tip is to think of management groups as folders in a file system—assigning permissions to the top folder automatically applies them to every subfolder and file inside, so always look for the highest scope that covers all required resources.
⚠ Common exam trap
It's easy for candidates to think they must assign roles at the subscription or resource group level for granularity, overlooking that management group scope provides automatic inheritance to all child scopes, which is the most efficient way to grant permissions across an entire hierarchy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign Reader at the Corp management group scope.
Assigning the Reader role at the Corp management group scope applies the role to all current and future subscriptions and resource groups within that management group hierarchy. This is because Azure RBAC roles assigned at a management group scope are inherited by all child management groups, subscriptions, and resources, ensuring the compliance team can read all resources across the entire Corp hierarchy without needing separate assignments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign Reader at the RG-Finance resource group scope.
Why it's wrong here
This only grants access to one resource group and does not cover other subscriptions under Corp.
When this WOULD be correct
This option would be correct if the requirement was to grant read access only to resources within the RG-Finance resource group, and not to any other resources in the subscriptions or management group.
- ✓
Assign Reader at the Corp management group scope.
Why this is correct
This scope covers all subscriptions currently under Corp and any subscriptions added later beneath that management group.
- ✗
Assign Reader separately at each subscription scope.
Why it's wrong here
This works for current subscriptions but requires extra assignments whenever a new subscription appears.
When this WOULD be correct
If the requirement was to grant Reader access only to existing subscriptions without covering future ones, or if the compliance team only needed access to specific subscriptions rather than all under a management group, assigning at each subscription scope would be appropriate.
- ✗
Assign Reader only at the individual resource scope.
Why it's wrong here
This would be far too narrow and would not provide access to the rest of the environment.
When this WOULD be correct
This option would be correct if the requirement was to grant read access to a single specific resource only, with no need to cover other resources or future ones, and no management group or subscription-level inheritance needed.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign Reader at the Corp management group scope.Correct answer▾
Why this is correct
This scope covers all subscriptions currently under Corp and any subscriptions added later beneath that management group.
✗Assign Reader at the RG-Finance resource group scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader at the RG-Finance resource group scope would only grant read access to resources within that specific resource group, not to all current and future resources in every subscription under the Corp management group. The requirement is for all subscriptions under Corp, which is a broader scope.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to grant read access only to resources within the RG-Finance resource group, and not to any other resources in the subscriptions or management group.
Why candidates choose this
Candidates may think that assigning the role at a resource group level is sufficient because it covers a subset of resources, or they may misunderstand the scope hierarchy and believe that a resource group assignment can propagate to other resource groups.
✗Assign Reader separately at each subscription scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader separately at each subscription scope would not cover future subscriptions added under the Corp management group, violating the requirement to read all current and future resources.
★ When this WOULD be the correct answer
If the requirement was to grant Reader access only to existing subscriptions without covering future ones, or if the compliance team only needed access to specific subscriptions rather than all under a management group, assigning at each subscription scope would be appropriate.
Why candidates choose this
Candidates may think that assigning at each subscription scope is sufficient and simpler, overlooking the need to cover future subscriptions automatically via management group inheritance.
✗Assign Reader only at the individual resource scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader at the individual resource scope would require manual assignment for every resource, failing to cover future resources and violating the requirement to read all current and future resources across all subscriptions under Corp.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to grant read access to a single specific resource only, with no need to cover other resources or future ones, and no management group or subscription-level inheritance needed.
Why candidates choose this
Candidates may think assigning at the most granular level is safest or least privileged, not realizing that management group scope provides inheritance to all child subscriptions and resources, including future ones.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, the Prod management group contains three subscriptions that host application workloads. An operations group must be able to read all current and future resources in those Prod subscriptions, but it must not have access to Sandbox. Where should you assign the Reader role?
medium- A.Assign Reader to OpsGroup at the Corp management group.
- ✓ B.Assign Reader to OpsGroup at the Prod management group.
- C.Assign Reader to OpsGroup at one application resource group in AppSub1.
- D.Assign Reader to OpsGroup at each subscription individually.
Why B: Assigning the Reader role at the Prod management group scope ensures that OpsGroup inherits read permissions to all current and future subscriptions and resources within that management group, while excluding the Sandbox subscription which is outside the Prod hierarchy. This leverages Azure RBAC inheritance, where roles assigned at a management group propagate to all child subscriptions and resource groups, meeting the requirement for a single assignment that covers all Prod workloads without granting access to Sandbox.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.