AZ-104 Manage Azure Identities and Governance Practice Question
You need to assign the same RBAC role to 15 administrators so they can manage backups for several virtual machines. You want to minimize ongoing administrative effort when membership changes. What should you use?
⚠ Common exam trap
Many candidates confuse resource locks (which prevent changes) with RBAC role assignments (which grant permissions), leading candidates to incorrectly select option C as a way to control access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Microsoft Entra group and a single role assignment to the group.
Assigning a single RBAC role to a Microsoft Entra group allows you to manage permissions centrally. When membership changes, you only need to add or remove users from the group, and the role assignment automatically applies to the new members. This minimizes ongoing administrative effort compared to managing individual role assignments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A Microsoft Entra group and a single role assignment to the group.
Why this is correct
A Microsoft Entra group gives you a single identity object that can be scoped to a management group, subscription, or resource group. Assigning the RBAC role once to that group means all 15 administrators inherit the same permissions automatically, and future access changes are made by editing group membership rather than adding or removing individual role assignments. This supports least privilege and simplifies audits because the role assignment, role definition, and scope are all explicit.
- ✗
A separate custom role assignment for each administrator.
Why it's wrong here
Individually assigning a role to each of the 15 administrators technically grants the needed access, but it multiplies the number of role assignments that must be tracked, audited, and cleaned up. If one person leaves or changes role, you must locate and remove their specific assignment, and adding a new admin requires creating yet another assignment. This duplication creates assignment sprawl and increases the risk of stale permissions being left behind; grouping centralizes this maintenance.
When this WOULD be correct
If the question required assigning roles with different permissions to each administrator (e.g., each needs a unique set of actions), then separate custom role assignments would be necessary because a group cannot accommodate individual permission differences.
- ✗
A resource lock on every virtual machine.
Why it's wrong here
Azure resource locks are a governance control that protects a virtual machine from deletion or modification by any user, including an Owner, not an authorization mechanism. Placing a lock on every VM does not grant any administrator permission to perform administrative actions; it only blocks destructive operations and can actually prevent the admins from completing needed tasks. RBAC assignments, not locks, are what define who can act on the resource.
When this WOULD be correct
A question asking how to prevent accidental deletion of critical virtual machines by administrators would make resource locks the correct answer, especially if the scenario emphasizes protection against unintended changes rather than access control.
- ✗
A policy exemption for the administrators.
Why it's wrong here
Azure Policy exemptions are used to exclude specific resources from a policy initiative's compliance evaluation, such as making an exception to an allowed-location policy. They are scoped to a resource or resource group and have no relation to a user's identity or permissions, so exempting administrators from a policy does nothing to grant them access to VMs. An exemption does not create, modify, or delegate an RBAC role; it only alters whether a policy definition is evaluated for compliance.
When this WOULD be correct
When administrators need to bypass a specific Azure Policy that blocks backup operations for certain VMs, and you want to exempt their actions without altering the policy for everyone.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Microsoft Entra group and a single role assignment to the group.Correct answer▾
Why this is correct
A Microsoft Entra group gives you a single identity object that can be scoped to a management group, subscription, or resource group. Assigning the RBAC role once to that group means all 15 administrators inherit the same permissions automatically, and future access changes are made by editing group membership rather than adding or removing individual role assignments. This supports least privilege and simplifies audits because the role assignment, role definition, and scope are all explicit.
✗A separate custom role assignment for each administrator.Wrong answer — click to see why▾
Why this is wrong here
Creating a separate custom role assignment for each administrator increases administrative effort because each membership change requires updating individual assignments, contradicting the goal of minimizing ongoing effort.
★ When this WOULD be the correct answer
If the question required assigning roles with different permissions to each administrator (e.g., each needs a unique set of actions), then separate custom role assignments would be necessary because a group cannot accommodate individual permission differences.
Why candidates choose this
Candidates may think custom roles offer more control or assume that individual assignments are needed for auditing or granular permissions, overlooking the efficiency of group-based assignments for identical roles.
✗A resource lock on every virtual machine.Wrong answer — click to see why▾
Why this is wrong here
Resource locks prevent accidental deletion or modification of resources but do not grant permissions to manage backups. They are not a mechanism for assigning RBAC roles.
★ When this WOULD be the correct answer
A question asking how to prevent accidental deletion of critical virtual machines by administrators would make resource locks the correct answer, especially if the scenario emphasizes protection against unintended changes rather than access control.
Why candidates choose this
Candidates may confuse resource locks with access control, thinking they can restrict who can manage backups, or they may misremember locks as a way to enforce role assignments.
✗A policy exemption for the administrators.Wrong answer — click to see why▾
Why this is wrong here
A policy exemption is used to exclude resources from Azure Policy evaluation, not to assign RBAC roles. It does not grant permissions to manage backups.
★ When this WOULD be the correct answer
When administrators need to bypass a specific Azure Policy that blocks backup operations for certain VMs, and you want to exempt their actions without altering the policy for everyone.
Why candidates choose this
Candidates may confuse policy exemptions with role assignments, thinking they can 'exempt' administrators from needing explicit permissions, or misunderstand the purpose of Azure Policy vs. RBAC.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.