Based on the exhibit, what should you configure so the analysts can manage group membership without granting Azure resource permissions?

Assign the service desk analysts the User Administrator role in Microsoft Entra ID.

This role can manage many directory objects, not just one application group. It is broader than the requirement and increases privilege unnecessarily.

Create separate local administrator accounts for each analyst.

Local administrator accounts are unrelated to Microsoft Entra group membership and would not delegate control over the cloud group.

Assign Contributor on the subscription to the service desk analysts.

Contributor grants broad Azure resource management permissions and does not solve Entra group membership delegation. It is far more access than needed.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Add the service desk analysts as owners of the App-Support group. — Making the service desk analysts owners of the App-Support Microsoft Entra security group gives them the ability to add and remove members for that one group. They do not need access to Azure subscriptions or resource groups to perform this task. This is the correct balance of delegation and least privilege, because the access is limited to group administration rather than broader directory or Azure resource administration. Why others are wrong: User Administrator is a directory-wide administrative role and is much broader than managing one support group. Local administrator accounts are not an Entra delegation mechanism and do not help with cloud group membership. Subscription-level Contributor is an Azure RBAC role for resource management, not directory membership, and would violate the requirement to avoid granting Azure permissions.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.