AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Current access review Team members: - Asha Khan - Ben Miller - Chen Wu - Dana Ortiz All four users need Contributor access to rg-app today. Requirement: The team changes every month. When people join or leave, the administrator wants to update one membership list instead of editing Azure role assignments for each user.
Based on the exhibit, which identity should be granted the Contributor role so access can be managed centrally as team members change?
⚠ Common exam trap
A common mix-up: candidates think assigning roles to individual users (Option A) is simpler or more direct, overlooking the centralized management and scalability benefits of using a security group, or they confuse managed identities (Option C) with user identities, not realizing managed identities are for Azure resources, not human users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign Contributor to a Microsoft Entra security group that contains the team members.
Assigning the Contributor role to a Microsoft Entra security group that contains the team members allows access to be managed centrally. As team members join or leave, you simply add or remove them from the group, and their permissions update automatically without needing to modify role assignments for each individual user. This aligns with Azure RBAC best practices for centralized identity governance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign Contributor to each user account individually.
Why it's wrong here
Assigning Contributor to each user account individually would technically work, but every new hire or departure would require you to create or remove a separate role assignment. This creates a significant maintenance workload and increases the risk of leaving stale permissions for users who have left the team. The requirement specifically calls for minimizing this administrative overhead, which is exactly why a group-based assignment is the recommended approach. Individual assignments also make auditing and access reviews more difficult because you must track multiple assignments instead of one.
When this WOULD be correct
This option would be correct if the question required granting the Contributor role to specific users who are not part of a group or managed identity, and centralized management was not a requirement (e.g., a one-time assignment for a fixed team).
- ✓
Assign Contributor to a Microsoft Entra security group that contains the team members.
Why this is correct
Assigning the Contributor role to a Microsoft Entra security group creates a single role assignment that covers all current and future team members. When you add or remove users from the group, their access to rg-app updates automatically because the group itself is the principal bound to the role. This avoids the administrative burden of editing multiple individual role assignments and follows the least privilege principle because the role is scoped exactly to the application's resource group.
- ✗
Assign Contributor to a managed identity.
Why it's wrong here
A managed identity is a workload identity intended for Azure resources such as virtual machines, App Services, or Azure Functions to authenticate to Azure services. It is not a grouping construct for human users, and assigning Contributor to a managed identity would grant permissions to the underlying resource that uses that identity, not to the team members. Therefore, it fails to provide the team with access to rg-app. Human access should be managed with a security group, which is specifically designed to represent a set of users.
When this WOULD be correct
A question where a virtual machine or Azure function needs to access Azure resources (e.g., Key Vault, Storage) programmatically, and the solution must avoid storing credentials. Assigning Contributor to a managed identity would be correct.
- ✗
Assign Contributor to the management group that contains rg-app.
Why it's wrong here
A management group is a hierarchical container that can encompass multiple subscriptions and every resource group inside them. If you assign Contributor at the management group that contains rg-app, the role will be inherited by all descendant resource groups and resources, greatly exceeding the intended scope. This violates the security principle of least privilege and would grant the team access to unrelated workloads. The correct scope is the resource group itself, not a parent management group.
When this WOULD be correct
This option would be correct if the question asked for granting Contributor role to all resources within an entire management group hierarchy, and the requirement was to manage access at the management group scope, not per team member changes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign Contributor to a Microsoft Entra security group that contains the team members.Correct answer▾
Why this is correct
Assigning the Contributor role to a Microsoft Entra security group creates a single role assignment that covers all current and future team members. When you add or remove users from the group, their access to rg-app updates automatically because the group itself is the principal bound to the role. This avoids the administrative burden of editing multiple individual role assignments and follows the least privilege principle because the role is scoped exactly to the application's resource group.
✗Assign Contributor to each user account individually.Wrong answer — click to see why▾
Why this is wrong here
Assigning Contributor to each user individually does not allow centralized management of access as team members change; each new member would require a separate assignment, and removals would need manual updates.
★ When this WOULD be the correct answer
This option would be correct if the question required granting the Contributor role to specific users who are not part of a group or managed identity, and centralized management was not a requirement (e.g., a one-time assignment for a fixed team).
Why candidates choose this
Candidates may think that assigning roles directly to users is simpler and more straightforward, overlooking the need for centralized, scalable access management as team membership changes.
✗Assign Contributor to a managed identity.Wrong answer — click to see why▾
Why this is wrong here
A managed identity is an Azure AD identity used by Azure resources to authenticate to services without storing credentials, not for assigning roles to human team members. It cannot be used for central access management as team members change.
★ When this WOULD be the correct answer
A question where a virtual machine or Azure function needs to access Azure resources (e.g., Key Vault, Storage) programmatically, and the solution must avoid storing credentials. Assigning Contributor to a managed identity would be correct.
Why candidates choose this
Candidates may confuse managed identities with security groups, thinking they can be used for role assignments to users, or they may recall that managed identities are a best practice for resource access without understanding their limitation to non-human identities.
✗Assign Contributor to the management group that contains rg-app.Wrong answer — click to see why▾
Why this is wrong here
Assigning Contributor to the management group that contains rg-app would grant the role to all subscriptions and resource groups under that management group, not just to the specific team members. The question requires central management as team members change, which is best achieved via a security group, not a management group.
★ When this WOULD be the correct answer
This option would be correct if the question asked for granting Contributor role to all resources within an entire management group hierarchy, and the requirement was to manage access at the management group scope, not per team member changes.
Why candidates choose this
Candidates may confuse management groups with security groups, thinking that assigning roles at the management group level provides centralized control, but they overlook that management groups control scope, not identity membership.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Security group
A security group is a virtual firewall that controls inbound and outbound traffic to AWS resources, such as EC2 instances, based on defined rules.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.