AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create a security group in Microsoft Entra ID for the application access.

  Why this is correct

  Security groups are the standard Entra ID container for access management. They let you grant permissions once and control membership centrally, which is ideal for a support team that will add and remove users often.

• ✓

  Add the service desk staff as owners of that group.

  Why this is correct

  Adding the service desk staff as owners of the Entra ID security group grants them delegated permission to manage group membership without conferring any of the group's Azure resource access rights. Ownership is a directory-level admin capability that allows adding or removing members, but it does not inherit the entitlements of the group itself, so the support team can administer the group without being able to use the application — a clean separation that satisfies the least-privilege principle and supports frequent membership changes.

• ✗

  Assign the service desk staff Contributor on the subscription.

  Why it's wrong here

  Assigning the service desk staff the Contributor role on the subscription grants them broad Azure resource management rights — such as creating or deleting resources, configuring storage, and managing virtual machines — which far exceeds the narrow need to administer a group's membership. Additionally, Contributor is an Azure RBAC role that applies only to Azure control-plane resources; it has no authority in Microsoft Entra ID and cannot touch security groups. This approach would expose the whole subscription to unnecessary risk while still not enabling the required identity-management task.

  When this WOULD be correct

  If the question required granting a team full management rights to all resources in a subscription (e.g., to deploy and manage infrastructure), then assigning Contributor on the subscription would be correct.

• ✗

  Convert the service desk staff into guest users in the tenant.

  Why it's wrong here

  Converting the service desk staff to guest users would change their identity type in the tenant, which can invalidate existing directory assignments and introduce unnecessary complexity for an internal support function. Guest accounts have no more group-management ability than members unless explicitly granted an ownership or administrative role, so simply converting them does not delegate anything. Moreover, guest status can cause access issues with internal resources, making this both an ineffective and a disruptive solution.

• ✗

  Add the service desk staff as members only, without ownership.

  Why it's wrong here

  Adding the service desk staff as members only allows them to use the application access granted by the group, but they will have no capability to manage its membership. In Microsoft Entra ID, group membership control is restricted to group owners or delegated directory admins; regular members have no built-in permission to add or remove others. Thus, this arrangement fails to satisfy the requirement for the service desk to maintain user access, because they can only consume the access and cannot delegate it.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question