AZ-104 Manage Azure Identities and Governance Practice Question
Your company has two Azure subscriptions named Dev-Sub and Prod-Sub. You need to ensure that a user can create resource groups only in Dev-Sub and nowhere else. What should you do?
⚠ Common exam trap
A common mix-up: candidates confuse the Contributor role with the Reader role, or incorrectly assume that assigning a role at a management group scope can be used to limit permissions to a single subscription, not realizing that management group scope inheritance applies to all child subscriptions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the Contributor role at the Dev-Sub subscription scope.
The Contributor role allows a user to create and manage resources, including resource groups, within the assigned scope. By assigning this role at the Dev-Sub subscription scope, the user gains the necessary permissions to create resource groups only in that subscription, as Azure RBAC permissions are inherited downward but not across sibling scopes. This ensures the user cannot create resource groups in Prod-Sub or any other subscription.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign the Contributor role at the Dev-Sub subscription scope.
Why this is correct
Assigning Contributor at the Dev-Sub subscription scope grants the user full management rights over all resources and resource groups inside that subscription, including permission to create new resource groups via Microsoft.Resources/subscriptions/resourceGroups/write. Because the scope is limited to Dev-Sub, this role assignment does not extend to Prod-Sub, and unlike Owner, Contributor cannot modify role assignments. This is the correct least-privilege choice for the stated requirement.
- ✗
Assign the Owner role at the tenant root scope.
Why it's wrong here
Owner at tenant root scope ('/') is a tenant-wide role assignment that applies to every subscription and management group in the Azure AD tenant, not just Dev-Sub. As Owner, the user could also create and manage role assignments for anyone in the tenant, including granting themselves or others access to Prod-Sub. This is vastly more permissive than creating resource groups in one subscription and violates the principle of least privilege.
When this WOULD be correct
This option would be correct if the requirement was to grant a user full administrative control over the entire Azure AD tenant, including all subscriptions and management groups, such as for a global administrator who needs to manage all resources across the organization.
- ✗
Assign the Reader role at the Dev-Sub subscription scope.
Why it's wrong here
The Reader role at the Dev-Sub subscription scope provides only read-only access, allowing the user to view existing resources but not to perform write operations. Creating a resource group requires Microsoft.Resources/subscriptions/resourceGroups/write, which is not included in Reader. As a result, the administrator would be unable to create any resource groups in Dev-Sub, directly failing the requirement.
When this WOULD be correct
If the question required a user to view resource groups and their properties in Dev-Sub without making any changes, assigning the Reader role at the Dev-Sub subscription scope would be correct.
- ✗
Assign the Contributor role at the management group scope that contains both subscriptions.
Why it's wrong here
Assigning Contributor at the management group scope that contains both Dev-Sub and Prod-Sub causes the role to be inherited by every subscription under that management group. Unlike a subscription-scoped assignment, this would grant the user Contributor permissions in Prod-Sub as well as Dev-Sub, allowing modifications to production resources. Even though Contributor cannot delegate permissions like Owner, this still exceeds the requirement because it adds access to Prod-Sub.
When this WOULD be correct
If the requirement were to grant a user the ability to create resource groups in all subscriptions under a management group (e.g., for a centralized DevOps team managing multiple subscriptions), assigning Contributor at the management group scope would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign the Contributor role at the Dev-Sub subscription scope.Correct answer▾
Why this is correct
Assigning Contributor at the Dev-Sub subscription scope grants the user full management rights over all resources and resource groups inside that subscription, including permission to create new resource groups via Microsoft.Resources/subscriptions/resourceGroups/write. Because the scope is limited to Dev-Sub, this role assignment does not extend to Prod-Sub, and unlike Owner, Contributor cannot modify role assignments. This is the correct least-privilege choice for the stated requirement.
✗Assign the Owner role at the tenant root scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning the Owner role at the tenant root scope grants full administrative access to the entire Azure AD tenant, including all subscriptions, which would allow the user to create resource groups in both Dev-Sub and Prod-Sub, not just Dev-Sub.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to grant a user full administrative control over the entire Azure AD tenant, including all subscriptions and management groups, such as for a global administrator who needs to manage all resources across the organization.
Why candidates choose this
Candidates may think that assigning a high-level role like Owner at the tenant scope is a way to grant broad permissions, but they overlook that it grants access to all subscriptions, not just the intended one.
✗Assign the Reader role at the Dev-Sub subscription scope.Wrong answer — click to see why▾
Why this is wrong here
The Reader role only allows read access, not the ability to create resource groups. The user needs write permissions to create resource groups.
★ When this WOULD be the correct answer
If the question required a user to view resource groups and their properties in Dev-Sub without making any changes, assigning the Reader role at the Dev-Sub subscription scope would be correct.
Why candidates choose this
Candidates may confuse the Reader role with the Contributor role, thinking that 'Reader' might still allow creation of resource groups, or they may not fully understand the specific permissions granted by each role.
✗Assign the Contributor role at the management group scope that contains both subscriptions.Wrong answer — click to see why▾
Why this is wrong here
Assigning Contributor at the management group scope that contains both subscriptions would grant the user Contributor permissions on both Dev-Sub and Prod-Sub, allowing resource group creation in both, which violates the requirement to restrict creation to Dev-Sub only.
★ When this WOULD be the correct answer
If the requirement were to grant a user the ability to create resource groups in all subscriptions under a management group (e.g., for a centralized DevOps team managing multiple subscriptions), assigning Contributor at the management group scope would be correct.
Why candidates choose this
Candidates may think that using a management group is a more efficient way to manage permissions across multiple subscriptions, but they overlook that it would grant access to all child subscriptions, not just Dev-Sub.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.