AZ-104 Manage Azure Identities and Governance Practice Question
Your company has an Microsoft Entra ID tenant and an Azure subscription. A new employee named Sam joins the company and must be able to sign in to the Azure portal and manage all resources in the subscription. You need to grant Sam the necessary access with the least administrative effort. What should you do?
⚠ Common exam trap
The trap here is selecting Contributor because it seems sufficient for resource management, but Owner is needed for full control including access management, and it is a built-in role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new Microsoft Entra ID user account for Sam and assign the Owner role at the subscription scope.
The most efficient way to give Sam full management access is to create an Microsoft Entra ID user account and assign the built-in Owner role at the subscription scope. Owner includes all permissions of Contributor plus the ability to manage access. Using a built-in role minimizes administrative effort, and subscription scope ensures Sam can manage all resources. Custom roles or lesser roles would not fully meet the requirement or would require extra configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Invite Sam as a guest user and assign the Reader role at the subscription scope.
Why it's wrong here
The Reader role only allows viewing resources, not managing them, so Sam could not create or modify resources. Inviting as a guest is appropriate for external users, but Sam is a new employee, so a member account is more appropriate. This option fails both the management requirement and the least administrative effort for an internal employee.
- ✗
Create a new Microsoft Entra ID user account for Sam and assign a custom role that allows all actions except role assignment write.
Why it's wrong here
Creating a custom role requires additional effort compared to using a built-in role, and the resulting permissions are essentially those of the Contributor role. While it would allow managing resources, it does not grant the ability to manage access, which might be needed for full subscription management. This approach is unnecessarily complex and does not meet the least administrative effort criterion.
- ✓
Create a new Microsoft Entra ID user account for Sam and assign the Owner role at the subscription scope.
Why this is correct
Creating an Microsoft Entra ID user account provides Sam with sign-in credentials, and assigning the Owner role at the subscription scope grants full management access to all resources. This is the simplest and most direct method to meet the requirement. It uses built-in role-based access control and requires no custom roles or complex configurations, aligning with least administrative effort.
- ✗
Create a new Microsoft Entra ID user account for Sam and assign the Contributor role at the subscription scope.
Why it's wrong here
The Contributor role allows managing all resources but does not permit granting access to others or managing role assignments. The requirement is to manage all resources, which Contributor satisfies, but the question asks for the least administrative effort and implies full management. Owner includes all Contributor permissions plus access management, making it more suitable for a resource administrator who may need to delegate.
Go deeper
Related to this question
Learn chapter
Managing Blob Access Tiers at Scale
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,053 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.