The service desk needs to add and remove users from a support group that grants access to an internal application, but the service desk must not receive Azure subscription permissions. Which two actions should you take? Select two.

Assign the service desk staff Contributor on the subscription.

Contributor would grant broad Azure resource management permissions far beyond group administration. It does not address the requirement to manage only the group membership.

Convert the service desk staff into guest users in the tenant.

Guest status changes the account type but does not automatically grant safe delegation for group administration. It also adds unnecessary identity complexity for an internal support task.

Add the service desk staff as members only, without ownership.

Members can use the access granted by the group, but they cannot manage membership unless they are owners. That does not satisfy the delegation requirement.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create a security group in Microsoft Entra ID for the application access. — A security group gives you a central place to control application access, and assigning service desk staff as owners lets them manage membership without any Azure subscription permissions. This is the least-privilege approach for delegated access administration in Microsoft Entra ID. It keeps access changes focused on identity management rather than Azure resource management. Why others are wrong: Contributor on the subscription is far too broad for a simple membership task. Guest accounts are not a delegation mechanism, and membership alone does not allow user management. The requirement is to delegate control of the group, not to expand Azure RBAC or change account types.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.