AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Tenant hierarchy:
- Corp (management group)
- Sales (subscription)
- RG-Web
- RG-Data
- Research (subscription)
- RG-Lab
Requirement from the business owner:
- Auditors must view all resources in Sales.
- Any new resource group created under Sales must also be covered.
- Auditors must not see resources in Research.Based on the exhibit, where should you assign the Reader role so the Auditors group can read every current and future resource in the Sales subscription, including resource groups created later, while not granting access to the Research subscription?
⚠ Common exam trap
Many candidates choose the management group scope (Option C) thinking it is necessary to cover multiple subscriptions, but they overlook the requirement to exclude the Research subscription, making the subscription-level scope the only correct choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign Reader to the Sales subscription, because subscription-level scope includes all current and future resource groups and resources in that subscription.
Assigning the Reader role at the Sales subscription scope grants the Auditors group read access to all current and future resource groups and resources within that subscription. This is because Azure RBAC roles assigned at a subscription level are inherited by all child resource groups and resources, including those created later. The requirement explicitly excludes the Research subscription, so a subscription-level assignment is the correct and most efficient approach.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign Reader to RG-Web, because the group can then inherit access to resources in that resource group only.
Why it's wrong here
Assigning Reader at the RG-Web scope limits access to only that resource group and the resources it currently contains; RG-Data, which also resides in the Sales subscription, would remain completely inaccessible to the auditors. Additionally, this scope does not cover any future resource groups created in the Sales subscription, so new resources would automatically be excluded. Because the requirement is to grant read access across all current and future resources in Sales, a single resource-group assignment is insufficient and far narrower than the required subscription-level scope.
When this WOULD be correct
If the requirement were to grant read access only to resources within a specific resource group (e.g., RG-Web) and not to other resource groups in the same subscription, then assigning the Reader role at the resource group scope would be correct.
- ✓
Assign Reader to the Sales subscription, because subscription-level scope includes all current and future resource groups and resources in that subscription.
Why this is correct
Subscription scope is the narrowest scope that satisfies the requirement. RBAC inheritance flows downward, so a Reader assignment at the Sales subscription applies to all current and future resource groups and resources inside Sales, but it does not grant access to the Research subscription.
- ✗
Assign Reader to the Corp management group, because that is the only scope that can cover multiple subscriptions.
Why it's wrong here
The Corp management group is the root management group that contains both the Sales and Research subscriptions, so a Reader assignment at this scope would inherit down to every subscription beneath it, granting auditors read access to Research, which is explicitly prohibited. Management group scope is not the only way to cover multiple subscriptions; you can assign the Reader role directly at the Sales subscription scope to achieve the desired coverage without spilling permissions. Using a management group when subscription scope suffices violates the principle of least privilege, because it expands the blast radius far beyond the stated requirement.
When this WOULD be correct
If the question required granting read access to all current and future resources across multiple subscriptions (e.g., Sales and Research) under the Corp management group, then assigning the Reader role at the management group scope would be correct.
- ✗
Assign Reader to each resource individually, because that avoids inheritance and limits visibility to selected items.
Why it's wrong here
Assigning Reader individually to each resource requires enumerating every resource, and you must repeat this process for every resource created in the future, making it operationally burdensome and highly prone to omissions. This approach ignores Azure RBAC’s inheritance model, which is designed to propagate permissions from parent scopes to child resources. Even if you could track all resources today, any new resource group or resource deployed by a template would lack access until you manually add another role assignment, so it fails the requirement for full, ongoing coverage in the Sales subscription.
When this WOULD be correct
This would be correct if the requirement was to grant read-only access to only a few specific resources (e.g., two virtual machines) and explicitly deny access to all other resources in the subscription, while avoiding any inheritance from higher scopes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign Reader to the Sales subscription, because subscription-level scope includes all current and future resource groups and resources in that subscription.Correct answer▾
Why this is correct
Subscription scope is the narrowest scope that satisfies the requirement. RBAC inheritance flows downward, so a Reader assignment at the Sales subscription applies to all current and future resource groups and resources inside Sales, but it does not grant access to the Research subscription.
✗Assign Reader to RG-Web, because the group can then inherit access to resources in that resource group only.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader to RG-Web only grants read access to resources within that specific resource group, not to all current and future resources in the Sales subscription. The requirement is to read every resource in the Sales subscription, which requires subscription-level scope.
★ When this WOULD be the correct answer
If the requirement were to grant read access only to resources within a specific resource group (e.g., RG-Web) and not to other resource groups in the same subscription, then assigning the Reader role at the resource group scope would be correct.
Why candidates choose this
Candidates may think that assigning a role at a resource group is sufficient because they assume all resources are in that group, or they misunderstand that inheritance from subscription scope is needed to cover future resources.
✗Assign Reader to the Corp management group, because that is the only scope that can cover multiple subscriptions.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader to the Corp management group would grant read access to all subscriptions under that management group, including the Research subscription, which violates the requirement to not grant access to Research.
★ When this WOULD be the correct answer
If the question required granting read access to all current and future resources across multiple subscriptions (e.g., Sales and Research) under the Corp management group, then assigning the Reader role at the management group scope would be correct.
Why candidates choose this
Candidates may think that a management group is the only way to cover multiple subscriptions, but they overlook that the requirement is to restrict access to only the Sales subscription, not all subscriptions under Corp.
✗Assign Reader to each resource individually, because that avoids inheritance and limits visibility to selected items.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader to each resource individually would require manual updates for every new resource, failing to meet the requirement to read every current and future resource without granting access to the Research subscription. It also violates the principle of least privilege by not leveraging inheritance.
★ When this WOULD be the correct answer
This would be correct if the requirement was to grant read-only access to only a few specific resources (e.g., two virtual machines) and explicitly deny access to all other resources in the subscription, while avoiding any inheritance from higher scopes.
Why candidates choose this
Candidates may think that assigning roles at the resource level gives precise control and avoids unintended access, but they overlook the administrative overhead and the requirement for future resources.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.