AZ-104 Manage Azure Identities and Governance Practice Question

• A.Management group scope
• B.Subscription scope
• ✓ C.Resource group scope
• D.Resource scope

Why C: The Contributor role assigned at the resource group scope grants the application team full management access to all resources within rg-app, but no access to resources in other resource groups or at the subscription level. This meets the requirement of restricting permissions to only that specific resource group.

• A.Individual user accounts
• ✓ B.An Entra ID security group
• C.A management group
• D.A resource lock

Why B: Using an Entra ID security group allows you to assign the Reader role to the group, then add or remove the 20 operators as members. This centralizes permission management: granting or revoking access is done by changing group membership rather than editing individual role assignments, which is more efficient and less error-prone.

• A.Keep assigning RBAC roles directly to each user account.
• ✓ B.Assign the RBAC role to an Entra ID group and manage membership there.
• C.Create a resource lock on RG-App.
• D.Create an Azure Policy assignment for RG-App.

Why B: The best practice is to assign the RBAC role to an Entra ID group instead of individual users. That way, access management is handled by adding or removing members from the group, which is much easier and less error-prone. The role assignment remains stable while team membership changes over time, which is exactly what the requirement describes. Why others are wrong: A works initially but becomes difficult to maintain as team membership changes. C does not control access at all. D is a governance mechanism, not an authorization mechanism, so it cannot replace group-based RBAC.

• ✓ A.Create an Entra ID security group for the contractor team.
• ✓ B.Assign the Reader role to that group at the application resource group scope.
• C.Assign Reader directly to the contractor's user object at the subscription scope.
• D.Assign Contributor at the resource group scope and rely on discipline.
• E.Use a resource lock to limit the contractor to read-only access.

Why A: Creating an Entra ID security group for the contractor team (Option A) allows the administrator to manage access centrally. By assigning the Reader role to that group at the application resource group scope (Option B), all members inherit read-only permissions. When the contractor leaves, removing their user object from the group immediately revokes access without needing to modify role assignments, satisfying the requirement for a single identity removal.

• ✓ A.Use a Microsoft Entra security group to represent application access.
• ✓ B.Add the service desk as an owner of that security group.
• C.Assign the service desk the Contributor role on the application resource group.
• D.Assign the service desk the User Administrator directory role to manage the application users.
• E.Create individual user assignments for every employee instead of using group-based access.

Why A: Using a Microsoft Entra security group creates a stable access boundary for the application, and making the service desk an owner lets them add or remove members without touching Azure RBAC. That is the least-privilege way to delegate access administration. It keeps resource permissions out of the model, avoids tenant-wide admin roles, and supports frequent employee changes cleanly through group membership updates. Why others are wrong: Contributor on a resource group gives Azure resource control, not just membership administration. User Administrator is a directory-wide role and is too broad for one application group. Individual user assignments defeat the goal of delegated membership management and create ongoing maintenance. The correct pattern is group-based access with delegated ownership.