AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Subscription: Sub-IT-01 Resource groups: - RG-App - vm-app01 - vm-app02 - RG-Shared - vm-dns01 Requirement: - Help desk operators can restart VMs in RG-App only. - They must not affect VMs in RG-Shared.
Based on the exhibit, help desk staff must restart virtual machines only in RG-App. What is the narrowest scope where you should assign the role?
⚠ Common exam trap
Watch out — candidates often choose the subscription scope (Option A) thinking it is simpler, but they overlook the requirement to restrict actions to only one resource group, violating the principle of least privilege.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the role at the RG-App resource group scope.
The narrowest scope that grants the necessary permissions to restart VMs only in RG-App is the resource group scope. Assigning the Virtual Machine Contributor role at the RG-App resource group level ensures that help desk staff can restart VMs within that specific resource group without having permissions to any other resources in the subscription or management group. This follows the principle of least privilege, limiting access to only what is required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the role at the subscription scope for Sub-IT-01.
Why it's wrong here
Assigning the role at the Sub-IT-01 subscription scope is broader than necessary because it grants the restart permission to every resource group in the subscription, including RG-Shared and any future resource groups. This would allow the help desk staff to restart VMs in RG-Shared, which is not part of the stated requirement, violating the principle of least privilege. The Microsoft.Authorization roleAssignments/write action would also apply across all subscriptions in the management group if inherited, but the immediate issue is over-permissioning within the subscription.
When this WOULD be correct
This option would be correct if the question asked for the narrowest scope to allow restarting VMs in all resource groups within Sub-IT-01, or if RG-App was the only resource group in the subscription and the requirement was to cover the entire subscription.
- ✗
Assign the role at the management group scope above the subscription.
Why it's wrong here
Assigning the role at the management group scope above Sub-IT-01 is even more over-privileged than a subscription-level assignment. Management group scopes propagate role assignments to all subscriptions and resource groups beneath them, meaning the help desk staff would be able to restart VMs across multiple unrelated subscriptions, not just Sub-IT-01. This is far beyond the requirement and creates a significant security and operational risk. A management group scope should only be used when the permission is required for all child subscriptions, which is not the case here.
When this WOULD be correct
If the question required granting permissions to restart VMs across multiple subscriptions that are all under the same management group, and the narrowest scope that covers all those subscriptions is the management group, then assigning the role at the management group scope would be correct.
- ✓
Assign the role at the RG-App resource group scope.
Why this is correct
The RG-App resource group scope is the narrowest scope that still contains both VMs that the help desk staff must restart, while excluding the RG-Shared resource group. Assigning a role at this scope inherits permissions to all VMs within the resource group, so both target VMs receive the Virtual Machine Contributor (or similar) restart permission in a single assignment. This honors least privilege because no resources outside RG-App are affected. It is the most appropriate and efficient scope for this requirement.
- ✗
Assign the role at the individual VM scope only.
Why it's wrong here
Assigning the role at the individual VM scope only would require creating a separate role assignment for each of the two VMs in RG-App, doubling the administrative overhead and making the configuration more error-prone. It also fails to scale: any new VM added to RG-App would need an additional assignment, whereas a resource group assignment automatically covers future VMs. While individual VM scope is valid and least-privileged, it is not the efficient choice when a single resource group scope covers both VMs without affecting other resources.
When this WOULD be correct
This option would be correct if the requirement was to allow help desk staff to restart only a specific VM (e.g., VM-01) and not any other VMs in the same resource group. For example, if the question stated 'help desk staff must restart only VM-01 in RG-App', then assigning the role at the individual VM scope would be the narrowest correct scope.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign the role at the RG-App resource group scope.Correct answer▾
Why this is correct
The RG-App resource group scope is the narrowest scope that still contains both VMs that the help desk staff must restart, while excluding the RG-Shared resource group. Assigning a role at this scope inherits permissions to all VMs within the resource group, so both target VMs receive the Virtual Machine Contributor (or similar) restart permission in a single assignment. This honors least privilege because no resources outside RG-App are affected. It is the most appropriate and efficient scope for this requirement.
✗Assign the role at the subscription scope for Sub-IT-01.Wrong answer — click to see why▾
Why this is wrong here
The question requires the narrowest scope that covers only RG-App. Assigning at the subscription scope (Sub-IT-01) would grant permissions to all resource groups within that subscription, not just RG-App, violating the 'narrowest scope' requirement.
★ When this WOULD be the correct answer
This option would be correct if the question asked for the narrowest scope to allow restarting VMs in all resource groups within Sub-IT-01, or if RG-App was the only resource group in the subscription and the requirement was to cover the entire subscription.
Why candidates choose this
Candidates may think the subscription is the smallest logical unit or assume that the role must be assigned at a higher level to ensure coverage, overlooking the resource group scope as a more precise option.
✗Assign the role at the management group scope above the subscription.Wrong answer — click to see why▾
Why this is wrong here
The management group scope is broader than the subscription, so assigning the role there would grant permissions to all subscriptions under that management group, not just Sub-IT-01 and specifically RG-App. The question requires the narrowest scope that covers only RG-App, which is the resource group scope.
★ When this WOULD be the correct answer
If the question required granting permissions to restart VMs across multiple subscriptions that are all under the same management group, and the narrowest scope that covers all those subscriptions is the management group, then assigning the role at the management group scope would be correct.
Why candidates choose this
Candidates may think that using a management group is a way to apply permissions broadly but still efficiently, or they may confuse management groups with resource groups, not realizing that management groups are higher-level containers that include multiple subscriptions.
✗Assign the role at the individual VM scope only.Wrong answer — click to see why▾
Why this is wrong here
The question requires that help desk staff restart VMs only in RG-App, but assigning the role at the individual VM scope would restrict them to only that specific VM, not all VMs in the resource group. The narrowest scope that covers all VMs in RG-App is the resource group scope.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to allow help desk staff to restart only a specific VM (e.g., VM-01) and not any other VMs in the same resource group. For example, if the question stated 'help desk staff must restart only VM-01 in RG-App', then assigning the role at the individual VM scope would be the narrowest correct scope.
Why candidates choose this
Candidates may think that assigning the role at the individual VM scope is the most restrictive and thus the 'narrowest' scope, but they overlook that the requirement is to restart all VMs in the resource group, not just one.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.