AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Microsoft Entra ID Group name: App-Support Type: Security Owners: None Members: 28 users Requirement: Service desk analysts must add and remove employees from App-Support each week. They must not receive permissions to Azure subscriptions, resource groups, or resources. Current approach: Analysts sign in with their regular work accounts.
Based on the exhibit, what should you configure so the analysts can manage group membership without granting Azure resource permissions?
⚠ Common exam trap
It's easy for candidates to confuse Microsoft Entra ID administrative roles (like User Administrator) with the more granular group ownership delegation, assuming that managing group membership requires a broader directory role rather than simply being added as an owner of the specific group.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the service desk analysts as owners of the App-Support group.
Adding the service desk analysts as owners of the App-Support group grants them the ability to manage group membership directly within Microsoft Entra ID (formerly Azure AD) without assigning any Azure RBAC permissions on resources. Group owners can add or remove members from the group, but they do not inherit any permissions to manage Azure resources like VMs or storage accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the service desk analysts the User Administrator role in Microsoft Entra ID.
Why it's wrong here
The Entra ID User Administrator role is a privileged directory role that can modify user accounts, reset passwords, manage MFA, and change group memberships for all groups in the tenant. Delegating that role to the service desk exceeds the goal because it grants access to directory-wide user objects, not just the App-Support group's membership list, increasing risk and violating least privilege.
When this WOULD be correct
This option would be correct if the question required analysts to manage all user accounts and groups in the directory, including resetting passwords and managing role assignments, and the scope of management was not limited to a single group.
- ✓
Add the service desk analysts as owners of the App-Support group.
Why this is correct
Adding the analysts as owners of the App-Support group grants them the least-privilege delegation to manage that group's membership in Microsoft Entra ID. Owners can add or remove members, but they receive no Azure RBAC permissions to the resources the group might access, so this satisfies the requirement without exposing broader administrative scope.
- ✗
Create separate local administrator accounts for each analyst.
Why it's wrong here
Local administrator accounts apply only to the operating system on a specific virtual machine or device and have no relationship to cloud directory objects. Even if the analysts were local admins on some server, that wouldn't allow them to modify Microsoft Entra ID group membership, so this approach is irrelevant to delegating control of the App-Support group.
When this WOULD be correct
This option would be correct in a scenario where analysts need to perform administrative tasks on on-premises or Azure VMs, such as installing software or configuring settings, and the question specifies that they should have local admin rights on those machines without any Azure resource or directory-level permissions.
- ✗
Assign Contributor on the subscription to the service desk analysts.
Why it's wrong here
The subscription-scope Contributor role grants the analysts full control over Azure resources, including VMs, storage, and networking, but it does not include any capability to modify Microsoft Entra ID groups because directory data is governed by Entra ID's own RBAC. This broad assignment would let them delete or change infrastructure while still failing to solve the group-membership delegation requirement, so it's both over-permissive and ineffective.
When this WOULD be correct
If the question required granting analysts the ability to manage all resources within a subscription (e.g., deploy and manage virtual machines, storage accounts, etc.) without granting administrative roles like Owner, then Contributor would be the correct role.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Add the service desk analysts as owners of the App-Support group.Correct answer▾
Why this is correct
Adding the analysts as owners of the App-Support group grants them the least-privilege delegation to manage that group's membership in Microsoft Entra ID. Owners can add or remove members, but they receive no Azure RBAC permissions to the resources the group might access, so this satisfies the requirement without exposing broader administrative scope.
✗Assign the service desk analysts the User Administrator role in Microsoft Entra ID.Wrong answer — click to see why▾
Why this is wrong here
The User Administrator role grants broad permissions to manage all users and groups in Microsoft Entra ID, including resetting passwords and managing roles, which exceeds the requirement to only manage group membership without granting Azure resource permissions.
★ When this WOULD be the correct answer
This option would be correct if the question required analysts to manage all user accounts and groups in the directory, including resetting passwords and managing role assignments, and the scope of management was not limited to a single group.
Why candidates choose this
Candidates may think that assigning a built-in directory role like User Administrator is the standard way to delegate group management, overlooking that it grants excessive privileges beyond just managing group membership.
✗Create separate local administrator accounts for each analyst.Wrong answer — click to see why▾
Why this is wrong here
Creating separate local administrator accounts for each analyst grants local machine administrative privileges, not the ability to manage group membership in Microsoft Entra ID, and does not address the requirement of managing Azure AD groups without granting Azure resource permissions.
★ When this WOULD be the correct answer
This option would be correct in a scenario where analysts need to perform administrative tasks on on-premises or Azure VMs, such as installing software or configuring settings, and the question specifies that they should have local admin rights on those machines without any Azure resource or directory-level permissions.
Why candidates choose this
Candidates may think that local admin accounts are a safe way to grant management capabilities without affecting Azure resources, misunderstanding that the question is about managing Microsoft Entra ID group membership, not local machine administration.
✗Assign Contributor on the subscription to the service desk analysts.Wrong answer — click to see why▾
Why this is wrong here
Assigning Contributor on the subscription grants full management access to all resources, including the ability to create, modify, and delete Azure resources, which goes beyond managing group membership and would grant Azure resource permissions.
★ When this WOULD be the correct answer
If the question required granting analysts the ability to manage all resources within a subscription (e.g., deploy and manage virtual machines, storage accounts, etc.) without granting administrative roles like Owner, then Contributor would be the correct role.
Why candidates choose this
Candidates may confuse the Contributor role with a limited management role, not realizing it provides broad resource permissions across the entire subscription, far exceeding the scope of managing group membership only.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.