AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Azure governance hierarchy
Root management group
└── Corp
├── Prod
│ ├── Sub-001
│ └── Sub-002
└── NonProd
├── Sub-101
└── Sub-102
Requirement: The audit team needs read-only access across all subscriptions that are or will be placed under Corp, without creating separate assignments for each subscription.Based on the exhibit, where should the Reader role be assigned so the audit team automatically has access to every current and future subscription under Corp?
⚠ Common exam trap
Candidates often choose subscription-level assignment (Option B) because they think it covers all resources in that subscription, but they overlook that the question requires access to every current and future subscription under Corp, which only management group inheritance can provide.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign Reader at the Corp management group scope.
Assigning the Reader role at the Corp management group scope uses Azure RBAC inheritance to grant the audit team read-only access to all current and future subscriptions under that management group. Because management group scope propagates role assignments to all child subscriptions and resource groups, this ensures automatic coverage without manual updates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign Reader at the Corp management group scope.
Why this is correct
Assigning the Reader role at the Corp management group scope is correct because Azure RBAC role assignments are inherited by all child scopes: subscriptions, resource groups, and resources that reside under that management group. Since Corp presumably contains all current and future subscriptions, a single assignment guarantees the audit team has read-only visibility across the entire hierarchy without needing further assignments. This aligns with the recommended practice of assigning roles at the highest applicable scope to minimize administrative overhead and ensure consistent access.
- ✗
Assign Reader at the subscription scope for Sub-001.
Why it's wrong here
Assigning Reader at the subscription scope for Sub-001 only grants access to that single subscription and has no effect on other subscriptions that may exist under the Corp management group. Each additional subscription would require a separate Reader assignment, and any subscription added to Corp in the future would also need its own assignment, defeating the purpose of centralized management. This option fails to meet the requirement for automatic, ubiquitous read access across the entire hierarchy, which the management group assignment provides.
When this WOULD be correct
If the question specified that the audit team only needs access to Sub-001 and no other subscriptions, or if the Corp management group did not exist and subscriptions were managed individually, then assigning Reader at the subscription scope for Sub-001 would be correct.
- ✗
Assign Reader at the resource group scope in each subscription.
Why it's wrong here
Assigning Reader at the resource group scope in each subscription is insufficient because a resource group is a lower-level scope than a subscription, so the assignment applies only to resources within that specific resource group, not to resources in other resource groups. To cover the whole environment, you would need to create a separate assignment for every resource group in every subscription, and any new resource group created later would be missed. This approach is operationally inefficient and does not leverage Azure's built-in inheritance; the management group scope is the correct target.
When this WOULD be correct
This option would be correct if the question required granting the audit team access to all resources within a specific resource group across multiple subscriptions, but not to other resource groups or subscriptions, and future subscriptions were not a concern.
- ✗
Assign Reader directly to each resource that the audit team might review.
Why it's wrong here
Assigning Reader directly to each resource the audit team might review is impractical and heavily error-prone, as it would require enumerating every existing resource and manually assigning the role to each one. New resources created after the assignment would not automatically inherit the role, so the audit team would lose visibility over time without constant updates. This approach also contradicts Azure RBAC's design, where inheritance flows from resource group to resource, and it ignores the need for a single, maintainable control point; a management group assignment is the only option that scales.
When this WOULD be correct
If the question required granting the audit team access only to specific resources (e.g., a single storage account) and no other resources in the subscription or management group, then assigning Reader at the resource scope would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign Reader at the Corp management group scope.Correct answer▾
Why this is correct
Assigning the Reader role at the Corp management group scope is correct because Azure RBAC role assignments are inherited by all child scopes: subscriptions, resource groups, and resources that reside under that management group. Since Corp presumably contains all current and future subscriptions, a single assignment guarantees the audit team has read-only visibility across the entire hierarchy without needing further assignments. This aligns with the recommended practice of assigning roles at the highest applicable scope to minimize administrative overhead and ensure consistent access.
✗Assign Reader at the subscription scope for Sub-001.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader at the subscription scope for Sub-001 only grants access to that specific subscription, not to every current and future subscription under Corp. The requirement is for automatic access to all subscriptions, which requires assignment at the management group scope.
★ When this WOULD be the correct answer
If the question specified that the audit team only needs access to Sub-001 and no other subscriptions, or if the Corp management group did not exist and subscriptions were managed individually, then assigning Reader at the subscription scope for Sub-001 would be correct.
Why candidates choose this
Candidates may think assigning at the subscription level is sufficient because it covers all resources within that subscription, overlooking the need to cover multiple subscriptions and future ones automatically.
✗Assign Reader at the resource group scope in each subscription.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader at the resource group scope does not grant access to every current and future subscription under Corp; it only covers specific resource groups within a single subscription, failing to meet the requirement for automatic access across all subscriptions.
★ When this WOULD be the correct answer
This option would be correct if the question required granting the audit team access to all resources within a specific resource group across multiple subscriptions, but not to other resource groups or subscriptions, and future subscriptions were not a concern.
Why candidates choose this
Candidates may think resource group scope is sufficient because it covers multiple resources within a group, but they overlook the need for subscription-wide or management group-level inheritance to include all subscriptions and future ones.
✗Assign Reader directly to each resource that the audit team might review.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader at the resource level would require manual assignment to each resource, failing to provide automatic access to all current and future subscriptions under Corp. It does not scale and violates the principle of least privilege by granting access at too granular a level.
★ When this WOULD be the correct answer
If the question required granting the audit team access only to specific resources (e.g., a single storage account) and no other resources in the subscription or management group, then assigning Reader at the resource scope would be correct.
Why candidates choose this
Candidates may think that assigning the role directly to resources is the most secure approach, not realizing that management group or subscription scopes provide inheritance and reduce administrative overhead.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.