AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Owner

  Why it's wrong here

  Owner is the highest-privilege built-in role, encompassing all permissions of Contributor plus the ability to assign roles and manage access via Azure RBAC. Granting Owner to junior administrators would allow them to change access control, elevate other users' permissions, and modify or delete any resource in the scope. This is drastically more access than required for viewing resources and represents an unacceptable security risk for administrators who only need read-only visibility.

  When this WOULD be correct

  If the question required granting full administrative control over a subscription, including managing role assignments and all resources, then the Owner role would be correct. For example, 'You need to assign a role to a senior administrator who will manage access and resources in a subscription.'

• ✗

  Contributor

  Why it's wrong here

  Contributor grants full write access to resources in the assigned scope, allowing junior administrators to create, modify, and delete resources, as well as manage resource locks and execute actions like starting or stopping virtual machines. While it cannot assign role-based access control to others, it still goes far beyond view-only needs and exposes the environment to accidental or malicious configuration changes. The inclusion of write and delete actions violates the principle of least privilege, so it is not appropriate for a purely read-only requirement.

  When this WOULD be correct

  A question where junior administrators need to create and manage all resources in a subscription, but not assign access to others (e.g., 'You need to grant a team the ability to deploy and manage virtual machines, but not grant access to other users. Which role should you assign?').

• ✓

  Reader

  Why this is correct

  The Reader role is a built-in Azure RBAC role that grants read-only access to all management-plane resource information across the assigned scope, including properties, configuration, and status. It cannot create, modify, or delete resources, nor assign permissions, making it the correct least-privilege choice for junior administrators who only need to view resources. This role satisfies the requirement without introducing any write or action capabilities.

• ✗

  Monitoring Reader

  Why it's wrong here

  Monitoring Reader is a purpose-built role that grants access to read monitoring data only—such as metrics, logs, alert rules, and diagnostic settings—but it does not provide general read permission over resource configuration or properties. For example, a user with this role can see a virtual machine's CPU metrics but cannot read its storage profile or network interface settings. Because the requirement asks for visibility into all resources, not just their monitoring signals, this role is too narrowly scoped and would miss core resource details.

  When this WOULD be correct

  A question that asks: 'You need to grant a user read-only access to Azure Monitor data, alerts, and diagnostic settings, but not to other resources. Which role should you assign?'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question