Based on the exhibit, which identity should be granted the Contributor role so access can be managed centrally as team members change?

Assign Contributor to each user account individually.

Individual assignments work, but every join or leave would require editing multiple role assignments, which is exactly what the requirement wants to avoid.

Assign Contributor to a managed identity.

Managed identities are for Azure resources to authenticate to services, not for grouping human users for team-based access control.

Assign Contributor to the management group that contains rg-app.

Management group scope would grant the permission far more broadly than the single application resource group requires.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Assign Contributor to a Microsoft Entra security group that contains the team members. — A Microsoft Entra security group is the best choice because it separates the RBAC assignment from the changing list of users. The administrator assigns Contributor once to the group, and then manages team membership in one place as people join or leave. This is the standard approach for scalable, least-privilege access management in Azure. Why others are wrong: Assigning the role to individual users works but creates administrative overhead every time the team changes. A managed identity is for workloads, not for a human access roster. Management group scope would be too broad and would grant access to more than rg-app, which violates the requirement to keep the permissions centralized and limited.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.