Microsoft Azure Administrator (AZ-104) — All Questions

You need to grant a support engineer the ability to reset passwords and manage user accounts in Microsoft Entra ID, but not manage Azure resources like virtual machines. Which type of role assignment is appropriate?

• a.An Azure RBAC role such as Contributor at the subscription scope
• b.An Azure RBAC role such as Owner at the resource group scope
• c.A Microsoft Entra role such as User Administrator✓
• d.A custom Azure Policy definition assigned to the tenant

Microsoft Entra roles (like User Administrator) control access to Entra ID resources such as users, groups, and directory settings. Azure RBAC roles (Contributor, Owner) control access to Azure resources like VMs and storage, which is not what is needed here. The two role systems are separate, so managing directory objects requires an Entra role, not an RBAC assignment.

Your organization requires that no resource in the Production resource group can be accidentally deleted, but administrators must still be able to modify existing resources. Which resource lock should you apply?

• a.A ReadOnly lock on the subscription
• b.A CanNotDelete lock on the resource group✓
• c.A ReadOnly lock on the resource group
• d.A CanNotDelete lock combined with a ReadOnly lock

A CanNotDelete lock prevents deletion of resources while still allowing reads and modifications. A ReadOnly lock would block modifications too, which the requirement forbids. Locks applied at the resource group level are inherited by all resources within it.

You want to automatically enforce that every new storage account created in a subscription uses only the East US region. Which Azure governance feature should you use?

• a.Azure Policy with a deny effect on the location field✓
• b.A resource lock set to ReadOnly
• c.An Azure RBAC custom role that restricts regions
• d.A tag applied to the subscription

Azure Policy evaluates resources against rules and can use a deny effect to block creation of resources that do not meet conditions, such as an allowed-locations restriction. Resource locks and RBAC control who can act and whether resources can be deleted, but they cannot enforce property values like region. Tags are metadata and do not enforce anything by themselves.

You have several subscriptions and want to apply a single Azure Policy and consistent RBAC assignments across all of them at once. What should you use to organize the subscriptions?

• a.A single resource group containing all subscriptions
• b.Tags applied to each subscription
• c.A Recovery Services vault
• d.A management group containing the subscriptions✓

Management groups sit above subscriptions and let you apply policies and RBAC assignments that are inherited by all subscriptions within them. Resource groups exist inside a subscription and cannot contain subscriptions. Tags provide metadata but do not push governance settings down a hierarchy.

You need to group multiple users so you can assign an Azure RBAC role to all of them at once, and the membership should update automatically based on a user's department attribute. Which option should you configure?

• a.An assigned (static) security group
• b.A dynamic security group in Microsoft Entra ID✓
• c.A Microsoft 365 group with manual membership
• d.A management group

A dynamic security group uses membership rules based on user attributes (such as department), so users are added or removed automatically as their attributes change. Assigned groups require manual membership management. You can then assign an RBAC role to the group so all members inherit the access.