AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Current access model: - User: Alex has Reader on RG-App - User: Bri has Reader on RG-App - User: Chen has Reader on RG-App - User: Dana has Reader on RG-App Requirement: - All current project members should keep the same access. - If someone joins or leaves the team, access should be updated in one place.
Based on the exhibit, what is the best way to simplify access management for the project team?
⚠ Common exam trap
AZ-104 often tests the misconception that resource locks or Azure Policy control access, when in fact they govern resource lifecycle and compliance, not identity permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the RBAC role to an Entra ID group and manage membership there.
Assigning the RBAC role to an Entra ID group and managing membership centrally is the recommended approach because it decouples role assignments from individual user accounts. When team membership changes, you only update group membership rather than reassigning roles per user. This reduces administrative overhead and the risk of orphaned or excessive permissions, and it aligns with Azure's least-privilege and identity-governance best practices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Keep assigning RBAC roles directly to each user account.
Why it's wrong here
Assigning RBAC roles directly to each user account creates a high-maintenance, one-to-one mapping that must be manually updated on every join, departure, or role change. It also scatters permissions across individual assignments, making audits and least-privilege reviews cumbersome and error-prone. A group-based assignment centralizes these changes into a single membership update, but direct assignments lack that scalability.
- ✓
Assign the RBAC role to an Entra ID group and manage membership there.
Why this is correct
Assigning the RBAC role to an Entra ID group and managing membership there centralizes access control: when a user is added to or removed from the group, their effective permissions on RG-App update automatically. This leverages Azure's inheritance model, reduces administrative overhead, and enables dynamic membership rules or access reviews to keep entitlements current. It is the best practice for simplifying access at scale.
- ✗
Create a resource lock on RG-App.
Why it's wrong here
A resource lock on RG-App protects the resource group and its child resources from accidental deletion or modification by enforcing a delete or read-only restriction on all users. However, resource locks do not grant or deny any user's ability to read, write, or manage the resources—they operate at the management plane layer, not as an access control mechanism. Thus, a lock ignores the question of who should have access and cannot simplify permission assignment.
- ✗
Create an Azure Policy assignment for RG-App.
Why it's wrong here
An Azure Policy assignment for RG-App enforces organizational standards and compliance by evaluating resource configuration (e.g., allowed locations, required tags, or disallowed resource types) and auditing or denying non-compliant deployments. Policy is a governance tool that controls what resources can be created or modified, but it does not assign or manage user access permissions. Since the question is about simplifying user access, policy is fundamentally mismatched to the goal.
When this WOULD be correct
If the question asked for a way to enforce that all resources in RG-App must have a specific tag (e.g., 'CostCenter') to prevent non-compliant deployments, then creating an Azure Policy assignment would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign the RBAC role to an Entra ID group and manage membership there.Correct answer▾
Why this is correct
Assigning the RBAC role to an Entra ID group and managing membership there centralizes access control: when a user is added to or removed from the group, their effective permissions on RG-App update automatically. This leverages Azure's inheritance model, reduces administrative overhead, and enables dynamic membership rules or access reviews to keep entitlements current. It is the best practice for simplifying access at scale.
✗Create an Azure Policy assignment for RG-App.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy is used to enforce organizational standards and assess compliance, not to simplify access management. It does not grant or manage permissions for users.
★ When this WOULD be the correct answer
If the question asked for a way to enforce that all resources in RG-App must have a specific tag (e.g., 'CostCenter') to prevent non-compliant deployments, then creating an Azure Policy assignment would be correct.
Why candidates choose this
Candidates may confuse Azure Policy with RBAC, thinking policies can manage access, or they may believe policies can simplify management by automatically applying rules, but policies do not control user permissions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Emergency Access Break-Glass Accounts
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,053 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.