AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Assign Contributor to the administrator at the management group scope.

  Why it's wrong here

  A management group scope is an inherited container; Contributor assigned there would propagate to every subscription nested under that management group, which in a typical enterprise includes both Dev-Sub and Prod-Sub, thereby over-permissioning the administrator. Even in a contrived setup where only Dev-Sub sits beneath the management group, such a high-level assignment is administratively risky and violates the principle of least privilege, because any future subscription added to that management group would automatically also receive Contributor. The requirement is explicitly for Dev-Sub only, so the assignment must be scoped at the subscription level rather than the management group.

  When this WOULD be correct

  This option would be correct if the requirement was to grant the administrator the ability to create resource groups in all subscriptions under a management group (e.g., both Dev-Sub and Prod-Sub) and no restriction on Prod-Sub permissions existed.

• ✓

  Assign Contributor to the administrator at the Dev-Sub scope.

  Why this is correct

  Assigning Contributor at the Dev-Sub subscription scope grants the administrator permission to create and manage all resource types within that subscription, including resource groups and any resources inside them, without granting access to other subscriptions. Contributor deliberately excludes the 'Manage Access' permission, so the administrator cannot delegate roles to others, aligning with the principle of least privilege. This scope exactly matches the requirement to administer Dev resources, and because the role assignment is scoped to the subscription, it cannot affect Prod-Sub or any other Azure scope.

• ✗

  Assign Owner to the administrator at the resource group scope in Dev-Sub.

  Why it's wrong here

  Owner at a resource group scope is doubly problematic: Owner includes the 'Manage Access' ability, allowing the administrator to grant roles to themselves or others, which is far greater privilege than the required Contributor role provides. Additionally, the resource group scope may not exist at the time of the assignment, because the administrator must first have permission at the subscription level to even create the resource group, creating a circular dependency. Even if the resource group already existed, this scope would restrict the administrator to only that one resource group, preventing them from managing other resource groups or resources in Dev-Sub that need oversight.

  When this WOULD be correct

  This option would be correct if the requirement was for the administrator to have full control over a specific resource group in Dev-Sub, including the ability to manage role assignments and resources within that group, and no restrictions on permissions in other scopes.

• ✗

  Assign Reader to the administrator at the Prod-Sub scope and Contributor at the tenant root group.

  Why it's wrong here

  Reader at the Prod-Sub scope is unnecessary because the administrator's duties are confined to Dev resources; read-only access to production is both irrelevant and potentially a data exposure risk. More critically, Contributor at the tenant root group ('/') would grant contributor permissions to every management group, subscription, resource group, and resource across the entire Azure tenant, completely circumventing the intended restriction to Dev-Sub. Such a wide scope is among the most dangerous RBAC misconfigurations possible, as it effectively turns the administrator into a contributor over the whole organization, far beyond any legitimate requirement.

  When this WOULD be correct

  If the requirement were to allow the administrator to create resource groups in Dev-Sub while having read-only access to Prod-Sub (e.g., for monitoring purposes), then assigning Reader at Prod-Sub and Contributor at the tenant root group (or Dev-Sub) would be appropriate.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question