Based on the exhibit, which action should the administrator take so Contractor01 can manage the team membership without receiving Azure resource permissions?

Add Contractor01 as a member of the AppOps-Admins group.

Members inherit whatever the group is used for, but membership alone does not allow administering the group itself.

Assign Contractor01 the User Administrator role at the tenant scope.

User Administrator is much broader than required and grants directory-wide capabilities that exceed the stated need.

Assign Contractor01 Contributor on the subscription.

Contributor would allow resource management across the subscription and is far beyond simple group membership administration.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Add Contractor01 as an owner of the AppOps-Admins group. — The best choice is to make Contractor01 an owner of the Microsoft Entra group. Group ownership is the least-privilege way to let someone manage membership for that single group without granting Azure resource permissions or broad directory administration rights. This fits the requirement exactly: the contractor can add and remove members from AppOps-Admins, but does not gain rights over subscriptions, resource groups, or other groups. Why others are wrong: Adding the contractor as a member only gives them whatever access the group is meant to represent; it does not let them administer the group. User Administrator is a tenant-wide directory role and is too powerful for a temporary delegation task. Contributor on the subscription would permit resource changes across Azure resources, which is unrelated to group membership management and violates least privilege.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.