AZ-104 Manage Azure Identities and Governance Practice Question
Your company uses Microsoft Entra ID. A new engineer must be able to create virtual machines in RG-Dev but must not be able to assign roles to other users. Which built-in role should you assign at the RG-Dev scope?
⚠ Common exam trap
Candidates often confuse the Virtual Machine Contributor role with the Owner role, mistakenly thinking that any contributor-level role includes role assignment capabilities, when in fact only Owner and User Access Administrator have that permission.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Virtual Machine Contributor
The Virtual Machine Contributor role provides the exact permissions needed: it allows creating and managing virtual machines within the specified scope (RG-Dev), but explicitly does not include the ability to assign roles to other users. This role grants write access to compute resources while preserving the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Owner
Why it's wrong here
Owner is too permissive for this scenario because it provides full control over all resources in the resource group, including the ability to manage role assignments and delegate access to other users. Assigning Owner to the engineer violates the principle of least privilege, as the requirement only calls for VM management capabilities and does not justify the added security risk of allowing them to grant themselves or others elevated permissions.
When this WOULD be correct
Assign the Owner role at the RG-Dev scope when the engineer needs full control over all resources and user access, including role assignments, for that resource group.
- ✓
Virtual Machine Contributor
Why this is correct
Virtual Machine Contributor is the correct built-in role because it grants the engineer full management rights over virtual machines within the resource group scope—including creating, starting, stopping, and deleting VMs—while explicitly not allowing them to manage role assignments or grant access to others. The role also does not provide data plane access, such as RDP or SSH into the VM, which aligns with the requirement of managing the VM infrastructure without broader security control.
- ✗
User Access Administrator
Why it's wrong here
User Access Administrator is incorrect because it is designed solely for managing access to Azure resources, such as assigning roles to users, groups, and service principals. It does not include any permissions to create, start, or stop virtual machines, so the engineer would be able to control who has access but would be unable to perform any VM management tasks, directly contradicting the stated requirement.
When this WOULD be correct
If the requirement were to allow a user to manage user access to Azure resources, including assigning roles at a scope, then User Access Administrator would be correct.
- ✗
Reader
Why it's wrong here
Reader is insufficient because it grants only read-only access to resources, allowing the engineer to view virtual machines and their properties but not to create, update, or delete them. Since the engineer must be able to manage VMs, Reader fails the core requirement and would leave them unable to perform any administrative actions on virtual machines.
When this WOULD be correct
Assign the Reader role at the RG-Dev scope when the requirement is to allow a user to view virtual machines and their properties but not make any changes or create new resources.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Virtual Machine ContributorCorrect answer▾
Why this is correct
Virtual Machine Contributor is the correct built-in role because it grants the engineer full management rights over virtual machines within the resource group scope—including creating, starting, stopping, and deleting VMs—while explicitly not allowing them to manage role assignments or grant access to others. The role also does not provide data plane access, such as RDP or SSH into the VM, which aligns with the requirement of managing the VM infrastructure without broader security control.
✗OwnerWrong answer — click to see why▾
Why this is wrong here
The Owner role grants full access to all resources, including the ability to assign roles to other users, which violates the requirement that the engineer must not be able to assign roles.
★ When this WOULD be the correct answer
Assign the Owner role at the RG-Dev scope when the engineer needs full control over all resources and user access, including role assignments, for that resource group.
Why candidates choose this
Candidates may assume Owner is needed to create VMs, overlooking that Virtual Machine Contributor provides sufficient VM management permissions without the extra role assignment capability.
✗User Access AdministratorWrong answer — click to see why▾
Why this is wrong here
The User Access Administrator role allows assigning roles to other users, which violates the requirement that the engineer must not be able to assign roles.
★ When this WOULD be the correct answer
If the requirement were to allow a user to manage user access to Azure resources, including assigning roles at a scope, then User Access Administrator would be correct.
Why candidates choose this
Candidates may confuse the ability to create VMs with managing access, or think that any administrative task requires the User Access Administrator role.
✗ReaderWrong answer — click to see why▾
Why this is wrong here
The Reader role only allows read-only access to resources; it does not permit creating virtual machines, which is a requirement in the question.
★ When this WOULD be the correct answer
Assign the Reader role at the RG-Dev scope when the requirement is to allow a user to view virtual machines and their properties but not make any changes or create new resources.
Why candidates choose this
Candidates might mistakenly think Reader provides sufficient permissions for VM creation, or they confuse it with Contributor due to similar naming patterns.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Contributor role
The Contributor role is a built-in Azure role that grants full access to manage resources within a scope but does not allow granting access to other users.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.