AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Requested permissions: - Add or remove Azure RBAC role assignments for RG-Apps - Do not allow resource configuration changes - Do not allow resource creation or deletion Existing assignments: - SupportLead -> Reader - AppOwners -> Contributor
Based on the exhibit, a support lead must manage role assignments for RG-Apps so the team can grant or revoke access for others. The support lead must not be able to change resource configurations. Which role should you assign?
⚠ Common exam trap
It's easy for candidates to confuse the Contributor role (which can manage resources but not access) with the User Access Administrator role, or mistakenly think the Owner role is required for managing role assignments, overlooking the specific delegation capability of User Access Administrator.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User Access Administrator at RG-Apps
The User Access Administrator role at the RG-Apps scope allows the support lead to manage role assignments (grant or revoke access) for others without having permissions to modify resource configurations. This role is specifically designed for delegating access management while preventing changes to the resources themselves, which aligns with the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Owner at RG-Apps
Why it's wrong here
Owner inherits all Contributor actions and also adds Microsoft.Authorization/roleAssignments/write, so it can manage access, but it additionally allows deleting and modifying the RG-Apps resources themselves, including the ability to delegate access to the resource group's data plane. The scenario requires the support lead only to manage role assignments without enabling resource changes; giving Owner would expose the environment to unintended configuration changes or resource deletions. Thus Owner provides the required permission plus excessive permissions that violate the least-privilege constraint.
When this WOULD be correct
If the requirement were for a user to have full control over resources and role assignments at the resource group scope, including the ability to modify resources, then the Owner role would be correct.
- ✗
Contributor at RG-Apps
Why it's wrong here
The Contributor role includes full permission to create, modify, and delete resources within the resource group, but it explicitly does not grant the Microsoft.Authorization/roleAssignments/write action required to assign or remove roles. As a result, a support lead with Contributor can deploy and manage RG-Apps resources but cannot revoke or grant another user's RBAC permissions. Given the need to manage role assignments rather than modify the actual app resources, this role fails the core requirement.
When this WOULD be correct
A question where the requirement is for a user to deploy and manage resources (e.g., virtual machines, storage) but not manage access for others, and the scope is a resource group.
- ✓
User Access Administrator at RG-Apps
Why this is correct
User Access Administrator is designed specifically for managing Azure RBAC access without granting full resource configuration rights. Assigning it at the resource group scope lets the support lead create and remove role assignments for RG-Apps while avoiding unnecessary management permissions.
- ✗
Reader at RG-Apps
Why it's wrong here
Reader permits viewing resource details and settings, but its action list is limited to read operations; it does not include Microsoft.Authorization/roleAssignments/read, let alone write or delete for role assignments. Since the support lead must create and remove assignments, Reader at RG-Apps does not even allow the lead to read who currently has access, making it impossible to audit or modify permissions. This option is entirely insufficient for any management action on role assignments.
When this WOULD be correct
In a scenario where a user only needs to view resource configurations and properties without making any changes or managing access, such as a compliance auditor reviewing resource settings in a subscription.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓User Access Administrator at RG-AppsCorrect answer▾
Why this is correct
User Access Administrator is designed specifically for managing Azure RBAC access without granting full resource configuration rights. Assigning it at the resource group scope lets the support lead create and remove role assignments for RG-Apps while avoiding unnecessary management permissions.
✗Owner at RG-AppsWrong answer — click to see why▾
Why this is wrong here
The Owner role at RG-Apps includes full management access, including the ability to change resource configurations, which violates the requirement that the support lead must not be able to change resource configurations.
★ When this WOULD be the correct answer
If the requirement were for a user to have full control over resources and role assignments at the resource group scope, including the ability to modify resources, then the Owner role would be correct.
Why candidates choose this
Candidates may think Owner is necessary to manage role assignments because it has full permissions, overlooking that the User Access Administrator role specifically grants only access management without resource modification rights.
✗Contributor at RG-AppsWrong answer — click to see why▾
Why this is wrong here
The Contributor role allows managing resources but cannot grant or revoke role assignments to others, which is the primary requirement for the support lead.
★ When this WOULD be the correct answer
A question where the requirement is for a user to deploy and manage resources (e.g., virtual machines, storage) but not manage access for others, and the scope is a resource group.
Why candidates choose this
Candidates may confuse Contributor with User Access Administrator, thinking Contributor includes all management capabilities, but it lacks the ability to manage role assignments.
✗Reader at RG-AppsWrong answer — click to see why▾
Why this is wrong here
Reader role only allows read access to resources, not the ability to manage role assignments. The support lead needs to grant or revoke access for others, which requires role assignment permissions.
★ When this WOULD be the correct answer
In a scenario where a user only needs to view resource configurations and properties without making any changes or managing access, such as a compliance auditor reviewing resource settings in a subscription.
Why candidates choose this
Candidates may think Reader is sufficient because the support lead should not change resource configurations, but they overlook that managing role assignments requires higher privileges than read-only.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
User Access Administrator
A User Access Administrator is an IT professional responsible for managing who can access what resources in an organization, including creating, modifying, and revoking user accounts and permissions across systems.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.