AZ-104 Manage Azure identities and governance: 186 practice questions

12 of the 186 Manage Azure identities and governance questions in the Certsqill AZ-104 bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for AZ-104? Take the free 5-min readiness check →

1. Guest user: Which user type is created when the contractor accepts the invitation?

1. Guest user ✓

   External users invited via Azure B2B collaboration are created as Guest users in the Entra ID tenant. Guest users can access resources shared with them but have limited directory access compared to member users.
2. Managed identity

   Managed identities are automatically managed identities for Azure resources (like VMs) to authenticate with Azure services. They are not used for external human users.
3. Member user

   Member users are internal users created directly in the Entra ID tenant. External B2B invited users are always created as Guest users, not Member users.
4. Service principal

   A service principal is an identity for applications and services to authenticate with Azure resources. It is not used for human external contractors invited via B2B collaboration.

External users invited via B2B collaboration become Guest users in the Entra ID tenant — with restricted directory access compared to internal Member users.

2. Microsoft Entra ID P1 or P2: Which Microsoft Entra ID license tier is required to enable SSPR for all users?

1. Microsoft Entra ID Free

   Microsoft Entra ID Free provides SSPR only for cloud administrator accounts (not all users). SSPR for all users requires at minimum P1 licensing or a Microsoft 365 subscription with SSPR included.
2. Microsoft Entra ID P1 or P2 ✓

   Microsoft Entra ID P1 or P2 licenses are required to enable SSPR for all users. SSPR for cloud-only accounts with the Microsoft Entra ID Free tier requires Microsoft 365 license and has limitations — full SSPR for all scenarios requires at least P1.
3. Microsoft Entra ID P2 only

   SSPR is available with both P1 and P2 licenses, not P2 exclusively. P2 adds additional features like Identity Protection and Privileged Identity Management, but SSPR is included in P1.
4. No additional license is required beyond Microsoft Entra ID

   While some SSPR functionality exists at lower tiers, enabling SSPR for all non-admin users requires a P1 or P2 license. The Free tier restricts SSPR to global admins only.

Microsoft Entra ID P1 or P2 is required to enable SSPR for all users — the Free tier only allows SSPR for cloud admins.

3. Reader: Which built-in Azure RBAC role should be assigned?

1. Owner

   The Owner role grants full access including the ability to manage role assignments. This is excessive for a junior developer who should only view resources.
2. Contributor

   The Contributor role grants full read and write access to create, modify, and delete resources. It cannot manage access (role assignments), but it allows changes — violating the read-only requirement.
3. Reader ✓

   The Reader role grants read-only access to all resources within the assigned scope. Users can view resources but cannot create, modify, or delete anything.
4. User Access Administrator

   User Access Administrator allows managing role assignments but does not grant read access to resources. This role is for managing who has access, not for viewing resources.

The Reader role provides read-only access to all resources within its scope — no create, modify, or delete permissions.

4. Read-only access to RG-Prod resources: What is the user's effective access to resources in RG-Prod?

1. Contributor access to all resource groups equally because RBAC scope assignments cannot be overridden by Deny assignments

   Deny assignments can absolutely override Allow role assignments. This is a fundamental RBAC principle in Azure — Deny always wins.
2. Full Contributor access to RG-Prod because subscription-level role assignments take precedence over resource group Deny assignments

   This is incorrect. In Azure RBAC, Deny assignments are evaluated before Allow assignments regardless of scope. A Deny at a child scope overrides an Allow at a parent scope.
3. No access to RG-Prod because a Deny assignment at any scope revokes all access to that resource group

   The Deny assignment specified 'all write actions' — not all actions. A Deny on write actions does not revoke read access. The user retains read access (inherited from Contributor) unless reads are also explicitly denied.
4. Read-only access to RG-Prod resources; the Deny assignment overrides the Contributor role inherited from the subscription ✓

   Azure RBAC evaluates permissions as: explicit Deny assignments take precedence over all Allow assignments. The Contributor role inherited from the subscription is overridden by the explicit Deny assignment at RG-Prod scope. The user can still read (if no read Deny) but cannot write.

Azure RBAC: Deny assignments always override Allow assignments regardless of scope level. The write-action Deny at RG-Prod revokes write access; read access inherited from Contributor is retained.

5. Deny: Which Azure Policy effect enforces this?

1. Deny ✓

   The Deny effect prevents a resource from being created or updated if it violates the policy rule. Attempts to create a storage account without HTTPS-only enabled would be blocked at the ARM API layer before the resource is created.
2. Audit

   The Audit effect allows non-compliant resources to be created but generates a warning event in the audit log and marks the resource as non-compliant in the Azure Policy compliance dashboard. It does not block creation.
3. Append

   The Append effect adds fields to a resource request before it is created. It could be used to add the HTTPS-only property, but it does not block non-compliant resources — it modifies the resource properties instead.
4. DeployIfNotExists

   DeployIfNotExists deploys a related resource or configuration if it doesn't already exist. It is used for remediation of existing non-compliant resources, not for blocking creation of new ones.

Azure Policy Deny effect blocks non-compliant resource creation at the ARM API — the storage account creation request is rejected before the resource exists.

6. The deployment fails because a ReadOnly lock prevents: What happens?

1. The deployment succeeds because deployment slots are configuration changes, not new resources

   Azure deployment slots are independent resources (Microsoft.Web/sites/slots) — they require a create (PUT) operation. ReadOnly locks block all write operations including creates.
2. The deployment fails because a ReadOnly lock prevents creating new resources within the locked scope ✓

   A ReadOnly lock prevents all write operations including creating new child resources within the locked scope. Since a deployment slot is a new resource being created under the App Service, it is blocked by the ReadOnly lock.
3. The deployment succeeds because the lock applies to the resource group, not to individual resources within it

   Resource locks are inherited by all child resources within the locked scope. A lock on a resource group applies to all resources and child resources within that group.
4. The deployment fails only if the developer does not have Owner-level RBAC permissions

   Resource locks override RBAC permissions. Even an Owner cannot perform write operations blocked by a ReadOnly lock without first removing the lock. RBAC role level is irrelevant when a lock is in place.

ReadOnly locks block all write operations (including creates) within the locked scope. Creating a deployment slot is a write/create operation — blocked by the ReadOnly lock.

7. Create a new management group: Which approach efficiently applies policies to both Development and Testing whi

1. Assign the policies at the tenant root management group covering every subscription, then add a policy exemption that removes Production from scope

   Applying at the root affects all subscriptions and then relies on an exemption for Production. This apply-then-exempt pattern is inverted from best practice; grouping the target subscriptions is cleaner.
2. Assign the policies to each resource group inside the Development and Testing subscriptions so only those grouped resources are governed

   Resource-group-scoped assignments cover only resources in those specific resource groups. Newly created resource groups would not be covered automatically.
3. Create a new management group, add the Development and Testing subscriptions into it, and assign the governance policies to that management group ✓

   A management group is a container for organizing subscriptions. Assigning policies to it applies them to all member subscriptions through inheritance, so Development and Testing receive the policies while Production does not.
4. Assign the policies directly to the Development and Testing subscriptions one at a time, duplicating each assignment across both subscriptions

   Per-subscription assignment works but requires duplicate assignments and ongoing maintenance as subscriptions change. Management groups provide centralized management instead.

A management group containing Development and Testing subscriptions allows policy assignment at the management group level — policies inherit to both subscriptions without affecting Production.

8. Azure resource tags: Which Azure feature should be used?

1. Azure Management Groups

   Management groups organize subscriptions for governance and policy purposes. They do not provide granular resource-level cost tracking by project within a subscription.
2. Azure Policy with Audit effect

   Azure Policy can enforce that tags exist on resources (using Deny or Append effects), but Policy itself does not track costs. Tags are the mechanism for cost tracking; Policy can enforce tags are applied.
3. Azure resource groups

   Resource groups can help organize resources, but cost filtering by resource group only works if all resources for a project are in the same resource group. Tags provide more flexible cost tracking without requiring specific resource organization.
4. Azure resource tags ✓

   Azure resource tags are name-value pairs applied to resources (e.g., Project=Contoso). Tags appear in Azure Cost Management and the Cost and Usage reports as filterable dimensions, enabling per-project cost tracking and chargeback.

Azure tags are key-value pairs applied to resources that appear as filter dimensions in Azure Cost Management — the standard mechanism for project-based cost chargeback.

9. Security group: Which group type should be created in Microsoft Entra ID?

1. Security group ✓

   Security groups are used for managing access to Azure resources and applications. They can be assigned Azure RBAC roles, used in conditional access policies, and do not require Microsoft 365 licenses. They work for any Azure resource.
2. Dynamic group with membership rule based on department attribute

   Dynamic group is a membership type (rule-based), not a group type. Dynamic membership can be applied to Security groups or Microsoft 365 groups. The question asks for the group TYPE, and Security group is the correct type regardless of whether membership is dynamic or assigned.
3. Microsoft 365 group

   Microsoft 365 groups (formerly Office 365 groups) provide collaboration features (shared mailbox, Teams, SharePoint sites). While they can be assigned RBAC roles, they require Microsoft 365 licenses and are designed for collaboration — not for pure resource access management.
4. Distribution group

   Distribution groups (Distribution Lists) are Exchange email distribution groups — they cannot be used for Azure RBAC role assignments or security access control. They are for email distribution only.

Security groups are designed for Azure resource access management, RBAC role assignments, and application access — they don't require Microsoft 365 licenses.

10. Azure Advisor: Which Azure service provides cost optimization recommendations based on actual resource usage?

1. Azure Cost Management

   Azure Cost Management shows spending analysis and budget tracking. While it helps understand where money is being spent, it does not analyze usage patterns to recommend specific resource changes like VM rightsizing.
2. Azure Advisor ✓

   Azure Advisor analyzes your Azure usage and configurations and provides personalized recommendations across five categories: Cost, Security, Reliability, Operational Excellence, and Performance. The Cost category specifically identifies underutilized VMs and recommends resizing or shutting them down.
3. Azure Policy

   Azure Policy enforces governance rules on resource configurations. It does not analyze usage patterns or provide cost optimization recommendations.
4. Azure Monitor

   Azure Monitor collects and analyzes telemetry (metrics and logs) for monitoring and alerting. While it provides visibility into resource utilization, it does not generate cost optimization recommendations.

Azure Advisor provides personalized recommendations including Cost optimization — identifying underutilized VMs for resizing or shutdown based on actual usage metrics.

11. Azure Policy with the Deny effect: Which Azure feature enforces this restriction?

1. Azure Resource Manager locks on existing resource groups, which block changes to current resources but cannot restrict which region a new VM is created in

   Resource locks apply to existing resources or resource groups. They cannot target regions or prevent resource creation in specific locations.
2. Microsoft Entra Conditional Access policies keyed to sign-in location, which gate portal access by user IP but do not govern the deployment region chosen for a VM

   Conditional Access restricts where users can sign in based on IP or country, not which region a VM is deployed to. It is the wrong tool for constraining deployment location.
3. Azure Policy with the Deny effect, using the built-in Allowed locations definition to reject any VM deployment attempted outside the East US and West US regions ✓

   The built-in Allowed locations policy uses the Deny effect to block resource creation in non-approved regions, rejecting a VM deployment in an unlisted region with a policy violation error.
4. Azure RBAC custom roles scoping compute actions, which decide who may create VMs but cannot constrain the location parameter value that is passed to a deployment

   RBAC controls who can perform actions but cannot restrict which parameter values (like location) are used. Only Policy can enforce resource property constraints such as region.

Azure Policy enforces resource property constraints like location — the Deny effect blocks VM creation requests that specify non-approved regions.

12. Use the bulk create users feature in the Microsoft Entra: Which approach most efficiently accomplishes this ta

1. Write a Microsoft Graph PowerShell script using New-MgUser to loop through the CSV rows, which works but adds scripting effort the built-in portal feature avoids

   A Microsoft Graph PowerShell script (New-MgUser) can bulk-create users, but the admin center's built-in Bulk create feature is simpler and needs no scripting. Note New-AzADUser is the Azure PowerShell cmdlet, not the Entra ID one.
2. Create each of the 500 accounts one at a time in the Azure portal, entering every user's details manually through the new-user form for each individual record

   Creating 500 users individually is time-consuming and error-prone. The bulk create feature exists specifically to avoid this manual approach.
3. Export the existing directory users, append the new records to that exported file, and re-import it, which would attempt to overwrite current users rather than add new ones

   There is no native re-import-with-modifications feature for creating users. Editing an export and re-importing does not create new accounts and would target existing users.
4. Use the bulk create users feature in the Microsoft Entra admin center, uploading the CSV so all of the accounts are provisioned in a single operation with no scripting ✓

   The Microsoft Entra admin center's built-in Bulk create feature accepts a CSV template with user properties and creates all users in one operation without any scripting.

The Microsoft Entra admin center Bulk create feature accepts a CSV template and creates all users simultaneously — the most efficient no-code approach for 500 accounts.

Other AZ-104 domains

• Deploy and manage Azure compute resources — 169 questions →
• Implement and manage storage — 141 questions →
• Implement and manage virtual networking — 130 questions →
• Monitor and maintain Azure resources — 96 questions →
• All 722 AZ-104 questions →