AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Access review notes Requested access for user: auditor1 Scope needed: RG-Finance only Permitted actions: - View resource properties - View tags and configuration Prohibited actions: - Create, update, or delete resources - Access other resource groups Current assignment candidates: - Reader at subscription scope - Reader at RG-Finance scope - Contributor at RG-Finance scope
Based on the exhibit, an auditor needs to view all resources in RG-Finance but must not be able to make any changes. The auditor also should not have access to other resource groups. Which RBAC assignment best meets the requirement?
⚠ Common exam trap
Many candidates choose Reader at the subscription scope (Option A) thinking it is simpler and still read-only, but they overlook the requirement to restrict access to only one resource group, which subscription-level access violates due to inheritance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reader at RG-Finance scope, because it allows viewing without granting write permissions.
The Reader role at the RG-Finance scope grants read-only access to all resources within that specific resource group, preventing any modifications. This meets the auditor's requirement to view resources in RG-Finance without write permissions and without access to other resource groups, as the scope is limited to RG-Finance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reader at the subscription scope, because it is read-only and easy to manage.
Why it's wrong here
Reader at the subscription scope grants read-only access to every resource group and resource within the subscription, including non-finance workloads that the auditor is not authorized to see. RBAC permissions are inherited from the subscription down to all child scopes, so this assignment would give visibility far beyond RG-Finance. Even though the Reader role itself is non-destructive, the scope violates the principle of least privilege by exposing unrelated resources to the auditor. The correct approach is to scope the read-only role to the specific resource group (RG-Finance) to limit the auditor's visibility to only the finance resources they need to review.
When this WOULD be correct
If the requirement was to allow an auditor to view all resources across the entire subscription without making changes, and there was no restriction on accessing other resource groups, then Reader at subscription scope would be appropriate.
- ✓
Reader at RG-Finance scope, because it allows viewing without granting write permissions.
Why this is correct
Reader at the resource group scope gives the auditor visibility into the resources in RG-Finance without permitting changes. This is the narrowest built-in role and scope combination that satisfies the requirement to view the group only and avoid access to other resource groups.
- ✗
Contributor at RG-Finance scope, because the auditor needs to read tags and configuration.
Why it's wrong here
Contributor at the RG-Finance scope includes significant write and delete permissions, not just read access to tags and configuration. While Contributor can read all resource metadata, tags, and configuration, it also allows creating, deleting, and modifying resources within that resource group, which directly conflicts with the requirement that the auditor must not be able to make any changes. The auditor should receive a read-only role (such as Reader) that supports viewing tags and configuration without any write or management actions. Granting Contributor would expose the environment to accidental or malicious changes and is far broader than the minimal access needed for an audit.
When this WOULD be correct
If the auditor needed to view resources AND also required to manage tags or perform configuration changes (e.g., update tags, modify resource settings) but not delete resources, Contributor at RG-Finance scope would be appropriate.
- ✗
Reader at the management group scope, because all finance resources are grouped there.
Why it's wrong here
Management group scope would likely include many subscriptions and resource groups, not just RG-Finance. That would expose far more resources than the auditor is supposed to see. The question asks for the narrowest correct scope.
When this WOULD be correct
If the requirement was to allow an auditor to view all resources across multiple resource groups that are all under the same management group, and there was no restriction on accessing other resource groups, then Reader at the management group scope would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Reader at RG-Finance scope, because it allows viewing without granting write permissions.Correct answer▾
Why this is correct
Reader at the resource group scope gives the auditor visibility into the resources in RG-Finance without permitting changes. This is the narrowest built-in role and scope combination that satisfies the requirement to view the group only and avoid access to other resource groups.
✗Reader at the subscription scope, because it is read-only and easy to manage.Wrong answer — click to see why▾
Why this is wrong here
Reader at subscription scope grants read access to all resource groups in the subscription, including those outside RG-Finance, violating the requirement that the auditor should not have access to other resource groups.
★ When this WOULD be the correct answer
If the requirement was to allow an auditor to view all resources across the entire subscription without making changes, and there was no restriction on accessing other resource groups, then Reader at subscription scope would be appropriate.
Why candidates choose this
Candidates may think Reader is inherently safe and scope at subscription is simpler to manage, overlooking the need to restrict access to only RG-Finance.
✗Contributor at RG-Finance scope, because the auditor needs to read tags and configuration.Wrong answer — click to see why▾
Why this is wrong here
Contributor role grants write permissions (e.g., create, delete, modify resources), which violates the auditor's requirement to not make any changes. The auditor only needs read access.
★ When this WOULD be the correct answer
If the auditor needed to view resources AND also required to manage tags or perform configuration changes (e.g., update tags, modify resource settings) but not delete resources, Contributor at RG-Finance scope would be appropriate.
Why candidates choose this
Candidates may think Contributor is necessary for reading tags and configuration, but Reader already includes read access to all resource properties including tags and configuration.
✗Reader at the management group scope, because all finance resources are grouped there.Wrong answer — click to see why▾
Why this is wrong here
Reader at the management group scope grants read access to all resource groups under that management group, including those outside RG-Finance, violating the requirement that the auditor should not have access to other resource groups.
★ When this WOULD be the correct answer
If the requirement was to allow an auditor to view all resources across multiple resource groups that are all under the same management group, and there was no restriction on accessing other resource groups, then Reader at the management group scope would be appropriate.
Why candidates choose this
Candidates may assume that since all finance resources are grouped under a management group, assigning Reader at that scope is efficient and still read-only, overlooking that it grants access to other resource groups within the same management group.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Reader role
A Reader role is a predefined set of permissions in identity and governance systems that allows a user to view resources and data but not create, modify, or delete anything.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.