AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Management group layout:
- Corp
- Prod
- AppSub1
- AppSub2
- AppSub3
- Sandbox
- DevSub1
Requirement:
- OpsGroup must read everything in Prod only
- New subscriptions added under Prod should inherit access automaticallyBased on the exhibit, the Prod management group contains three subscriptions that host application workloads. An operations group must be able to read all current and future resources in those Prod subscriptions, but it must not have access to Sandbox. Where should you assign the Reader role?
⚠ Common exam trap
Many exam-takers choose subscription-level assignments (Option D) because they think it's more precise, but they miss the requirement for future resources and the efficiency of a single management group assignment that automatically covers new subscriptions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign Reader to OpsGroup at the Prod management group.
Assigning the Reader role at the Prod management group scope ensures that OpsGroup inherits read permissions to all current and future subscriptions and resources within that management group, while excluding the Sandbox subscription which is outside the Prod hierarchy. This leverages Azure RBAC inheritance, where roles assigned at a management group propagate to all child subscriptions and resource groups, meeting the requirement for a single assignment that covers all Prod workloads without granting access to Sandbox.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign Reader to OpsGroup at the Corp management group.
Why it's wrong here
The Corp management group is a higher-level scope that includes both Prod and Sandbox, so selecting it would inadvertently grant Reader access to Sandbox resources. Since RBAC assignments at a management group are inherited by all child subscriptions, resource groups, and resources, this assignment would exceed the stated security boundary. Scoping to Prod instead ensures Sandbox remains excluded while still covering all Prod subscriptions and future additions under Prod.
When this WOULD be correct
This option would be correct if the requirement was to grant read access to all resources under the Corp management group, including Sandbox, or if Sandbox was not under Corp.
- ✓
Assign Reader to OpsGroup at the Prod management group.
Why this is correct
Assigning at the Prod management group gives inherited read access to every subscription, resource group, and resource under Prod. It also automatically applies to future subscriptions added under Prod, while keeping Sandbox out of scope.
- ✗
Assign Reader to OpsGroup at one application resource group in AppSub1.
Why it's wrong here
Assigning Reader at the application resource group limits the permission boundary to only the resources within that single resource group. Resources in other resource groups within AppSub1, and every other subscription under Prod, would not receive Reader access, and future subscriptions added to Prod would not automatically inherit any permissions. This falls short of the requirement for uniform read-only access across all Prod subscriptions and their resources.
When this WOULD be correct
If the requirement were to grant read access only to a specific application resource group (e.g., for a single app's operations team) and not to other resources in the subscription, assigning Reader at that resource group would be correct.
- ✗
Assign Reader to OpsGroup at each subscription individually.
Why it's wrong here
Assigning Reader to each subscription individually is administratively redundant and hard to scale, as every new subscription added under Prod would require a separate assignment to maintain the same access. This approach also creates a risk of inconsistency, where some subscriptions might be missed during onboarding, leaving teams without the necessary read access. Management group scoping is the preferred method because a single assignment applies uniformly to all current and future child subscriptions under Prod.
When this WOULD be correct
If the requirement was to grant read access only to existing subscriptions without any future subscriptions, or if the subscriptions were not under a management group hierarchy, assigning at each subscription individually would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign Reader to OpsGroup at the Prod management group.Correct answer▾
Why this is correct
Assigning at the Prod management group gives inherited read access to every subscription, resource group, and resource under Prod. It also automatically applies to future subscriptions added under Prod, while keeping Sandbox out of scope.
✗Assign Reader to OpsGroup at the Corp management group.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader at the Corp management group would grant read access to all subscriptions under Corp, including Sandbox, which violates the requirement that OpsGroup must not have access to Sandbox.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to grant read access to all resources under the Corp management group, including Sandbox, or if Sandbox was not under Corp.
Why candidates choose this
Candidates may think assigning at a higher scope (Corp) is more efficient, overlooking that it would include unintended subscriptions like Sandbox.
✗Assign Reader to OpsGroup at one application resource group in AppSub1.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader at a single resource group in AppSub1 would only grant read access to that specific resource group, not to all current and future resources across all three Prod subscriptions as required.
★ When this WOULD be the correct answer
If the requirement were to grant read access only to a specific application resource group (e.g., for a single app's operations team) and not to other resources in the subscription, assigning Reader at that resource group would be correct.
Why candidates choose this
Candidates may think that assigning at a resource group is sufficient and simpler, overlooking the need for broader scope across multiple subscriptions and future resources.
✗Assign Reader to OpsGroup at each subscription individually.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader at each subscription individually would grant access to the three Prod subscriptions, but it would not cover future subscriptions added to the Prod management group, violating the requirement for future resources.
★ When this WOULD be the correct answer
If the requirement was to grant read access only to existing subscriptions without any future subscriptions, or if the subscriptions were not under a management group hierarchy, assigning at each subscription individually would be appropriate.
Why candidates choose this
Candidates may think that assigning at the subscription level is sufficient and more direct, overlooking the need for inheritance to cover future subscriptions under the management group.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
Reader role
A Reader role is a predefined set of permissions in identity and governance systems that allows a user to view resources and data but not create, modify, or delete anything.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, a compliance team must read all current and future resources in every subscription under the Corp management group. Where should you assign the Reader role?
easy- A.Assign Reader at the RG-Finance resource group scope.
- ✓ B.Assign Reader at the Corp management group scope.
- C.Assign Reader separately at each subscription scope.
- D.Assign Reader only at the individual resource scope.
Why B: Assigning the Reader role at the Corp management group scope applies the role to all current and future subscriptions and resource groups within that management group hierarchy. This is because Azure RBAC roles assigned at a management group scope are inherited by all child management groups, subscriptions, and resources, ensuring the compliance team can read all resources across the entire Corp hierarchy without needing separate assignments.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.