Domain 1: Manage Azure Identities and Governance (20-25%)
What this domain actually covers
Two planes of control that AZ-104 lumps together because the exam wants you to know when to reach for which.
Identity plane (Microsoft Entra ID, formerly Azure AD). Users, groups, licenses, external identities (B2B guests), administrative units, Entra roles, self-service password reset, MFA registration, Conditional Access basics, Entra Connect sync/hybrid identity concepts, App Proxy at a passing level.
Governance plane (Azure Resource Manager). Management groups, subscriptions, resource groups, tags, resource locks, Azure Policy (definitions, initiatives, assignments, exemptions, remediation, effects), Azure RBAC (built-in roles, custom roles, scope, assignment, deny assignments), and cost management basics (budgets, cost analysis, tags-driven cost views).
The exam repeatedly asks you to distinguish Entra roles (identity) from Azure RBAC roles (resources). They are entirely separate role systems that happen to have overlapping names. This is the single biggest source of missed points for working admins.
Questions
Q1
You assign a user the Entra ID role "User Administrator" and expect them to create resource groups in a subscription. They cannot. Why?- A. User Administrator does not grant control-plane permissions on Azure resources
- B. They also need the Global Administrator role
- C. Entra ID roles cascade to subscriptions only if security defaults are off
- D. Subscription-level permissions are inherited from tenant roles by default
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
True distinction: User Administrator manages directory users, not Azure resource creation.
Why this is not the answer
Real role: Global Administrator manages the directory; resource access requires separate Azure RBAC or explicit elevation.
Why this is not the answer
False rule: security defaults enforce identity protections; disabling them does not make directory roles inherit into subscriptions.
Why this is not the answer
False rule: tenant roles and Azure RBAC are separate; subscription permissions do not automatically inherit from Entra roles.
The reasoning
Entra ID roles manage identity objects (users, groups, apps). Azure RBAC roles manage Azure resources. The two role systems are separate. To create resource groups the user needs an Azure RBAC role such as Contributor or Owner at subscription scope (or an inherited parent scope). Global Admin can elevate access into Azure RBAC via a tenant-level toggle, but by itself does not grant resource permissions. Exam trap: if a question mentions Entra role + Azure operation, look for the plane mismatch first.
Field anchor: you use both planes in production; the exam is testing whether you can name which plane a specific role belongs to purely from its name.
Q2
You are creating a dynamic user group in Entra ID that should include all users where department equals "Finance" and country equals "US." Which rule syntax is correct?- A.
(user.department -eq "Finance") -and (user.country -eq "US") - B.
user.department == "Finance" AND user.country == "US" - C.
user.department eq "Finance" and user.country eq "US" - D.
user.department -eq "Finance" && user.country -eq "US"
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Valid syntax: -eq compares each attribute and -and requires both conditions to match.
Why this is not the answer
Invalid Entra syntax: == and bare AND resemble other languages; dynamic membership requires -eq and -and.
Why this is not the answer
Invalid Entra syntax: bare eq/and resemble OData operators; this rule language requires hyphenated operators.
Why this is not the answer
Invalid Entra syntax: && is familiar from other languages, but Entra dynamic membership uses -and.
The reasoning
Entra dynamic membership uses a PowerShell-flavored expression: -eq, -ne, -contains, -startsWith, -match, and boolean -and/-or/-not. Attributes are prefixed with user. or device.. The tenant needs enough Microsoft Entra ID P1 licenses to cover every unique user who belongs to dynamic groups; individual P1 assignment to those users is not required.
Field anchor: you have built Entra dynamic groups. Exam question style either shows you a rule and asks which users match, or gives a scenario and asks for the rule.
Q3 (multi-answer, pick two)
Select two roles that can reset the password of ANY user in Entra ID, including HIGH-PRIVILEGE administrators like Global Administrator.- A. Password Administrator
- B. Global Administrator
- C. Privileged Authentication Administrator
- D. Helpdesk Administrator
- E. User Administrator
Show answer & explain every option
Correct: B, C
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real role: Password Administrator resets supported nonprivileged accounts, not every high-privilege administrator.
✓ Correct choice
Real role: Global Administrator can reset all administrator/user passwords, but grants broad tenant administration.
✓ Correct choice
Real role: Privileged Authentication Administrator can reset authentication information/passwords for high-privilege administrators.
Why this is not the answer
Real role: Helpdesk Administrator has restricted reset targets, not universal administrator reset rights.
Why this is not the answer
Real role: User Administrator manages users and some administrator passwords, but not all highly privileged roles.
The reasoning
Only Global Administrator and Privileged Authentication Administrator can reset passwords for ANY user, INCLUDING high-privilege admins (Global Admin, Privileged Role Admin, Privileged Auth Admin themselves, etc.). Password Administrator, Helpdesk Administrator, and Authentication Administrator can only reset non-admin passwords. User Administrator (E) is a common wrong pick: it CAN reset most user and limited-admin passwords, but CANNOT reset Global Admin, Privileged Role Admin, or Privileged Auth Admin passwords. Exam trap: all five look "password-related" in the role list. The clean rule for "reset ANY password" is Global Admin + Privileged Authentication Admin.
Q4
Which Azure RBAC role can create custom Azure RBAC role definitions in a subscription?- A. User Access Administrator (on the subscription)
- B. Owner (on the subscription)
- C. Global Administrator (Entra role)
- D. Both A and B
Show answer & explain every option
Correct: D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real Azure role: User Access Administrator includes roleDefinitions/write. It qualifies, but the combined choice includes another qualifying role.
Why this is not the answer
Real Azure role: Owner can manage resources and role definitions. It qualifies, but is not the only qualifying choice. This is part of the answer; the combined choice includes the other applicable statements too.
Why this is not the answer
Real Entra role: Global Administrator manages directory objects; it needs explicit Azure access elevation before managing resource roles.
✓ Correct choice
Valid combination: both named Azure roles include roleDefinitions/write; choosing only one omits the other valid role.
The reasoning
Creating custom Azure RBAC role definitions requires the Microsoft.Authorization/roleDefinitions/write action. Owner and User Access Administrator both have it. Global Administrator (an Entra role) has no automatic Azure permission unless they elevate access via the tenant-level "Access management for Azure resources" toggle which grants User Access Administrator at root scope. This plane distinction is one of the top-frequency AZ-104 traps.
Field anchor: you have shipped custom RBAC roles; on the exam remember the roleDefinitions/write action is not part of Contributor.
Q5
What is the maximum number of custom Azure RBAC role DEFINITIONS you can create per tenant (Azure commercial)?- A. 500
- B. 2,000
- C. 5,000
- D. 10,000
Show answer & explain every option
Correct: C
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Numeric distractor: 500 is not the documented commercial-tenant custom-role definition limit; it names no Azure feature.
Why this is not the answer
Real limit in another cloud: 2,000 applies to Azure operated by 21Vianet, not this commercial tenant.
✓ Correct choice
Documented limit: 5,000 custom role definitions per commercial tenant; do not confuse definitions with assignments.
Why this is not the answer
Numeric distractor: 10,000 is not this limit. A plausible number is not a separate Azure capability.
The reasoning
Tenant limit for custom RBAC role definitions is 5,000 (2,000 in China 21Vianet). Role ASSIGNMENTS have a separate limit: 4,000 per subscription, excluding assignments inherited from management groups. Microsoft occasionally tests exact numbers. Azure Germany was retired 2021 so it no longer appears in current limit docs.
Q6
You create a management group hierarchy: Tenant Root Group -> Corp -> Prod. You assign the Reader role to an auditor at the Corp scope. Which resources can they read?- A. Only subscriptions directly under Corp
- B. Only management-group metadata
- C. All subscriptions and resources under Corp and Prod, including future additions
- D. Only resource groups in the current subscription
Show answer & explain every option
Correct: C
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real scope, incomplete coverage: inheritance includes nested management groups and their subscriptions, not just direct children.
Why this is not the answer
Real metadata, incorrect restriction: Reader inherited from this scope also covers descendant resource management information.
✓ Correct choice
True inheritance: the parent assignment covers descendants and future resources placed beneath that scope.
Why this is not the answer
Real resource groups, incorrect boundary: management-group inheritance is not limited to one currently selected subscription.
The reasoning
RBAC inherits down the hierarchy. Any assignment at a management group scope applies to all child management groups, subscriptions, resource groups, and resources, present and future. This is the primary reason management groups exist.
Q7
Which Azure Policy effect will REMEDIATE existing non-compliant resources when the assignment has a managed identity?- A. Audit
- B. Deny
- C. DeployIfNotExists
- D. Disabled
Show answer & explain every option
Correct: C
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real effect: Audit records noncompliance; it does not deploy or modify resources.
Why this is not the answer
Real effect: Deny rejects noncompliant creates or updates; it does not repair existing resources.
✓ Correct choice
Real effect: DeployIfNotExists can deploy missing configuration using the assignment identity and an explicit remediation task for existing resources.
Why this is not the answer
Real effect: Disabled stops policy evaluation; it provides no remediation.
The reasoning
DeployIfNotExists deploys a template; Modify applies modification operations. Existing resources require a remediation task, using the assignment's managed identity with sufficient permissions. Audit reports only. Deny blocks new or updated non-compliant resources but does nothing to existing ones. Remediation tasks are launched from the compliance blade after the assignment lands.
Q8
A subscription has aCanNotDelete lock on a resource group. Which of these operations is still permitted?
- A. Delete resources in the group
- B. Delete the resource group
- C. Modify resource properties (change VM size, update NSG rules)
- D. None of the above
Show answer & explain every option
Correct: C
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real operation, blocked: child resources inherit the deletion lock, so their control-plane deletion is denied.
Why this is not the answer
Real operation, blocked: deleting the resource group would delete the locked scope.
✓ Correct choice
Real operations, allowed by this lock: CanNotDelete permits updates; ReadOnly would restrict them. RBAC permissions are still required.
Why this is not the answer
False combination: modification remains possible, so not every listed operation is prohibited.
The reasoning
CanNotDelete blocks delete but permits reads and writes. ReadOnly blocks any write, including modifications, which frequently breaks non-obvious operations (restarting a VM with ReadOnly on the RG is blocked because restart is a control-plane POST action). Locks inherit from parent scope down.
Q9
You apply a tagCostCenter=Finance to a resource group. Which is TRUE about the resources inside?
- A. Resources inherit the tag automatically at creation
- B. Resources inherit the tag when they are modified next
- C. Resources do NOT automatically inherit tags from resource groups
- D. Only PaaS resources inherit tags
Show answer & explain every option
Correct: C
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
False default: resource-group tags are metadata on the group; inheritance needs configured policy or other automation.
Why this is not the answer
False default: modifying a resource does not automatically copy its group's tags without an applicable policy.
✓ Correct choice
True behavior: group tags do not automatically become resource tags; use a suitable Modify policy for inheritance.
Why this is not the answer
False distinction: PaaS resources do not gain special automatic resource-group tag inheritance.
The reasoning
Tags on a resource group do NOT propagate to child resources by default. To enforce inheritance you use an Azure Policy such as "Inherit a tag from the resource group" (Modify effect), then run a remediation task. Exam trap: Cost Management can pivot spend by resource-group tag, so the practical impact of "no inheritance" is subtler than it looks and shows up in cost-allocation scenarios.
Q10
Which Conditional Access signal would you use to require MFA only when a user signs in from a non-corporate IP?- A. User risk level
- B. Sign-in risk level
- C. Named locations
- D. Device compliance
Show answer & explain every option
Correct: C
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real Identity Protection signal: user risk estimates account compromise; it does not identify corporate IP ranges.
Why this is not the answer
Real Identity Protection signal: sign-in risk estimates a suspicious authentication event; it is not an IP allowlist.
✓ Correct choice
Real Conditional Access feature: named locations represent known IP ranges or countries and can scope/exclude locations in a policy.
Why this is not the answer
Real Intune-backed signal: compliance describes device posture, not whether a sign-in originates from the corporate network.
The reasoning
Named locations tag IP ranges (for example, corporate egress IPs) as trusted. An MFA policy can exclude the corporate named location and apply elsewhere. Exclusion from this policy does not override other policies or mandatory MFA requirements. Sign-in risk is an Entra ID Protection signal (P2). Device compliance is an Intune signal. Named locations only need Entra P1.
Field anchor: you have built CA policies. Exam trap: CA policies created from templates default to Report-only. Legacy per-user MFA state overrides CA in ways that surprise admins during migration; the modern replacement is Authentication methods policy + CA.
Q11 (multi-answer)
Which of the following are valid Azure RBAC scopes?- A. Management group
- B. Subscription
- C. Resource group
- D. Individual resource
- E. Individual property of a resource
Show answer & explain every option
Correct: A, B, C, D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real Azure RBAC scope: management groups apply inherited permissions across descendant subscriptions.
✓ Correct choice
Real Azure RBAC scope: a subscription contains resource groups and can inherit parent assignments.
✓ Correct choice
Real Azure RBAC scope: a resource group scopes permissions to its contained resources.
✓ Correct choice
Real Azure RBAC scope: an individual resource can receive an assignment directly.
Why this is not the answer
Invented general RBAC scope: individual resource properties are not a fifth Azure RBAC scope; service-specific data controls differ.
The reasoning
RBAC applies at four scopes: management group, subscription, resource group, individual resource. Properties inside a resource are controlled by resource-specific mechanisms (data actions on a storage container, POSIX ACLs on Data Lake Gen2, etc.). "Property scope" is a distractor.
Q12
A guest user (B2B) needs Contributor on a resource group. Guest invitation restrictions are set to "Admins and users in the Guest Inviter role only." What must happen first?- A. An admin (or Guest Inviter) sends a guest invitation via the Entra portal or Graph API
- B. The guest self-service signs up
- C. The guest's home tenant admin enables cross-tenant sync
- D. The subscription is upgraded to CSP
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real invitation flow: an authorized inviter creates the guest relationship before the resource role can be assigned.
Why this is not the answer
Real self-service feature: it requires a configured sign-up flow; it does not replace the invitation path described here.
Why this is not the answer
Real provisioning feature: cross-tenant synchronization is an alternative planned identity lifecycle, not a prerequisite for this invitation.
Why this is not the answer
Real billing program: Cloud Solution Provider changes purchasing arrangements, not guest-invitation authorization.
The reasoning
With restricted invitation settings only admins or Guest Inviter role members can invite. The guest lands as a userType = Guest object in your tenant, then RBAC assignment works normally. Cross-tenant sync is a different mechanism that pushes objects instead of inviting.
Q13
What is the difference between "Directory Readers" (Entra) and "Reader" (Azure RBAC)?- A. Directory Readers reads Entra objects (users, groups, apps). Azure Reader reads Azure resources.
- B. Directory Readers reads Azure resources. Azure Reader reads Entra objects.
- C. They are aliases for the same permission set.
- D. Directory Readers is deprecated.
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
True distinction: Directory Readers views directory information; Azure Reader views resource control-plane information.
Why this is not the answer
False reversal: both roles exist, but their directory/resource responsibilities are swapped here.
Why this is not the answer
False equivalence: the two role systems grant different permissions and are assigned independently.
Why this is not the answer
False retirement claim: Directory Readers is a documented Entra role, not a retired alias for Azure Reader.
The reasoning
Biggest naming trap on the exam. Directory Readers is least-privileged read on the tenant directory. Azure Reader is least-privileged read on Azure control-plane resources.
Field anchor: you use RBAC daily; the exam wants to see you can pick the plane a role belongs to purely from its name.
Q14
An initiative (policy set) contains 30 policies. You want to exempt ONE specific resource group from just ONE of those policies. Which mechanism?- A. Set the policy effect to
Disabledat the initiative level - B. Create a policy exemption at the resource group scope for that specific policy
- C. Remove the resource group from the assignment scope
- D. Add a policy exclusion at the initiative assignment
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real effect: Disabled can suppress evaluation, but changing assignment parameters is broader than exempting this one group.
✓ Correct choice
Real mechanism: an exemption can target this resource group and specific policy reference within the initiative.
Why this is not the answer
Real scope control, too broad: removing this group excludes all initiative policies applying through that assignment.
Why this is not the answer
Real exclusion, too broad: notScopes excludes the entire assignment at that scope, not just the one member policy.
The reasoning
Exemptions are the precise tool: scope + which policyDefinitionReferenceIds + category (Waiver or Mitigated) + optional expiration. Exclusions on the assignment remove ALL policies in the initiative for that scope, too broad. Disabling a policy through assignment parameters affects that assignment, rather than exempting only the chosen resource group.
Q15
A user cannot register for SSPR. You confirm SSPR is enabled for "Selected" groups. What must be true?- A. The user must have Entra ID P2
- B. The user must be in the selected SSPR group and have a qualifying license; registration must then be completed
- C. Password writeback must be enabled in Entra Connect
- D. The user must be in an Administrative Unit
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real license, overly strict claim: P2 qualifies, but other qualifying licenses can also enable cloud password reset.
✓ Correct choice
Real eligibility conditions: the user must be in scope and appropriately licensed before registering authentication methods.
Why this is not the answer
Real hybrid feature: writeback sends cloud password changes to on-premises AD; it is not universally required for cloud-only registration.
Why this is not the answer
Real directory scope: an administrative unit delegates administration; membership is not a prerequisite for SSPR registration.
The reasoning
SSPR eligibility depends on scope and licensing. Cloud-only password reset is included in Microsoft 365 Business Standard and Microsoft Entra ID P1/P2. Hybrid writeback requires P1/P2 or Microsoft 365 Business Premium. Registered methods are needed to complete a reset, not to begin registration.
Q16 (scenario)
Your company acquires a firm using a different Entra tenant. You need users in the acquired tenant to access resources in your tenant without re-inviting each user individually. Best-scaling feature?- A. B2B guest invitations per user
- B. Cross-tenant sync (multi-tenant organization)
- C. Federation with AD FS
- D. External Identities self-service sign-up
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real B2B feature: individual invitations work but require more per-user lifecycle management.
✓ Correct choice
Real cross-tenant provisioning: synchronization automates scoped B2B user provisioning between tenants with appropriate configuration.
Why this is not the answer
Real identity federation: AD FS handles authentication federation rather than automatically provisioning this cross-tenant user population.
Why this is not the answer
Real sign-up flow: users can initiate onboarding, but this differs from centrally managed tenant-to-tenant synchronization.
The reasoning
Cross-tenant sync (multi-tenant organization feature) pushes user objects from a source tenant to a target as B2B members automatically, filtered by scope. Per-user invitations work but do not scale. Federation is for identity providers, not tenant-to-tenant sync. Self-service sign-up is reactive.
Q17
Which built-in role lets a user assign roles to others at subscription scope but does NOT grant general resource modification permissions?- A. Owner
- B. User Access Administrator
- C. Contributor
- D. Managed Identity Operator
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real role: Owner includes access administration plus broad resource management, exceeding the requested permissions.
✓ Correct choice
Real role: User Access Administrator manages access without granting general resource modification; it still includes read and support permissions.
Why this is not the answer
Real role: Contributor manages resources but cannot assign Azure RBAC roles.
Why this is not the answer
Real role: Managed Identity Operator assigns user-assigned identities to resources; it does not generally administer subscription RBAC.
The reasoning
User Access Administrator permits role management and includes /read, Microsoft.Authorization/, and Microsoft.Support/*. It can read resource control-plane information. Owner additionally permits general resource changes; Contributor cannot assign Azure RBAC roles.
Q18
An Azure RBAC deny assignment (created by a deployment stack or Managed Application) blocks an action. Who can override it?- A. Any Owner at the same scope
- B. Only the object that created the deny assignment
- C. Global Administrator
- D. Nobody, deny assignments are absolute
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real role, false bypass: an Owner allow assignment does not defeat an applicable deny assignment.
✓ Correct choice
Real lifecycle control: the owning deployment stack or managed application controls its deny settings; this is not a user permission override.
Why this is not the answer
Real directory role, false bypass: Global Administrator does not automatically override Azure resource deny assignments.
Why this is not the answer
Overstated rule: a deny blocks applicable users, but its owning resource can change its configuration or lifecycle.
The reasoning
Deny assignments (a separate object from role assignments) cannot be edited or removed by users. They are managed by the creating resource (deployment stack, Managed App). Owners are still blocked by them. Global Administrator has no automatic Azure permission unless they elevate.
Q19
You need to grant a service principal read access to blobs in ONE storage account only. Correct role + scope?- A. Storage Account Contributor at the subscription
- B. Storage Blob Data Reader at the storage account
- C. Reader at the resource group
- D. Storage Blob Data Owner at the subscription
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real management role: it can manage accounts and list keys, but is broader than scoped Entra blob-read access.
✓ Correct choice
Real data role: Storage Blob Data Reader grants blob reads at the specified account without write permissions.
Why this is not the answer
Real control-plane role: Reader views resource configuration; it does not itself grant Entra-authorized blob-content reads.
Why this is not the answer
Real data role, excessive scope: Data Owner grants broader data rights across the subscription rather than one account.
The reasoning
Data-plane roles (Storage Blob Data Reader/Contributor/Owner) grant access to blob contents via Entra auth. Reader does not grant blob data access. Storage Account Contributor does not directly grant Entra blob data permissions, but can list account keys and thereby access data when Shared Key authorization is allowed. Least-privileged scope is the storage account itself.
Field anchor: you have shipped storage accounts. Exam trap: assigning Reader on a storage account does NOT let you read blobs; you need a data-plane role.
Q20
Which management group exists automatically in every tenant and cannot be deleted?- A. A management group named Corp
- B. Tenant Root Group
- C. Default Management Group
- D. Organization Management Group
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Example name: an administrator may create Corp, but Azure does not create that management group automatically.
✓ Correct choice
Real built-in root: one root management group exists per directory and cannot be moved or deleted.
Why this is not the answer
Real setting, different concept: a default management group controls placement of new subscriptions; it is not a second undeletable root.
Why this is not the answer
Invented built-in name: a custom group could use this label, but it is not Azure's automatically created root group.
The reasoning
Every directory has one root management group, initially displayed as Tenant Root Group. It cannot be deleted or moved. An appropriately authorized administrator can manage it; a Global Administrator can elevate to root-scope User Access Administrator if access must be recovered.
Q21
A cost budget is set at $10,000/month on a subscription. What happens when actual cost reaches the budget?- A. Resource creation is automatically blocked
- B. Only alerts fire per the configured action group; nothing is blocked
- C. All VMs shut down automatically
- D. The subscription enters read-only mode
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
False automatic behavior: a Cost Management budget does not block deployments at its threshold.
✓ Correct choice
Real budget behavior: configured notifications/actions can fire; enforcement requires separately configured automation.
Why this is not the answer
Real operation, not automatic: an action group and runbook could shut down VMs, but a budget alone does not.
Why this is not the answer
False automatic behavior: a budget alert does not place the subscription into read-only mode; spending limits are different.
The reasoning
Budgets in Cost Management are alerting-only. To actually stop resources you wire the budget alert to an action group that triggers a Function, Logic App, or Runbook to take action. Do not confuse with subscription spending limits (available on certain credit-based offers, such as free accounts and eligible Visual Studio subscriptions).
Q22
Correct order of RBAC evaluation when a user has multiple assignments?- A. Deny assignments first, then role assignments (union of permissions)
- B. Role assignments only; last-write-wins
- C. Whichever assignment is closest in scope wins
- D. Only management-group assignments count
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
True access model: applicable allow permissions accumulate, while applicable deny assignments remove permitted actions.
Why this is not the answer
False conflict rule: RBAC is not last-write-wins; older applicable role assignments still contribute permissions.
Why this is not the answer
False precedence rule: child scope does not replace inherited permissions simply because it is closer to the resource.
Why this is not the answer
False limitation: assignments at subscription, resource-group and resource scopes also participate.
The reasoning
Effective permissions = union of all role assignments at all applicable scopes, MINUS any deny assignments. Scope proximity does not matter; permissions are additive at the evaluated scope, including assignments inherited from parent scopes. Deny assignments always win.
Q23 (drag-and-drop style, pair each need with the right tool)
| Governance need | Correct tool |
|---|---|
| Restrict resource types allowed in a subscription | Azure Policy (Deny effect on allowedResourceTypes) |
| Prevent accidental deletion of a critical RG | Resource Lock (CanNotDelete) |
| Enforce naming standards on new resources | Azure Policy (Deny effect on regex mismatch) |
| Group multiple subscriptions for shared governance | Management Groups |
| Track spend per business unit | Tags + Cost Management |
Common exam pattern. Watch for "Azure Blueprints" as a distractor. Blueprints package policies + role assignments + templates together, useful for environment provisioning but overkill for any single item above. Microsoft has announced Blueprints retirement in favor of Deployment Stacks + Policy; if the exam has been refreshed post-cutoff, the tooling name may have shifted.
Q24
You want ALL new resources in a subscription to automatically get aEnvironment=Prod tag. Which policy effect?
- A. Audit
- B. Append
- C. Modify
- D. Deny
Show answer & explain every option
Correct: C
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real effect: Audit reports missing tags; it does not add them.
Why this is not the answer
Real effect: Append can add request properties, but Modify is the recommended tag mechanism and supports remediation.
✓ Correct choice
Real effect: Modify can add or replace the tag; eligible resources and policy scope still determine coverage.
Why this is not the answer
Real effect: Deny can reject a request missing the tag, but does not insert the tag for the caller.
The reasoning
Modify supports add, replace, and remove operations on tags and supports remediation of existing resources via a managed identity. Append can add tags at creation but cannot overwrite existing values and does not support remediation. Microsoft's current guidance recommends Modify.
Q25
What is a managed identity in Azure?- A. A user account managed by Microsoft
- B. A system-managed service principal in Entra ID, tied to an Azure resource, with credentials rotated automatically
- C. A group of admin accounts with restricted permissions
- D. An identity federated from an external IdP
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real object type, wrong identity: a managed identity is a service principal, not an ordinary user account.
✓ Correct choice
Real identity mechanism: Azure manages the service principal's credentials; system- and user-assigned lifecycles differ.
Why this is not the answer
Real groups, wrong concept: grouping administrators does not create a managed identity for a workload.
Why this is not the answer
Real federation concept: external identity federation is distinct from Azure-managed credentials for supported resources.
The reasoning
Managed identities eliminate credential storage in code. Two flavors: system-assigned (tied to the resource's lifecycle, deleted with it) and user-assigned (standalone resource, attachable to many targets). Under the hood: a service principal whose credentials Azure manages and rotates.
Q26 (multi-answer)
Which are valid Entra ID base license tiers?- A. Entra ID Free
- B. Entra ID P1
- C. Entra ID P2
- D. Entra ID Premium P3
- E. Entra ID Governance (add-on)
Show answer & explain every option
Correct: A, B, C
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real base offering: Entra ID Free provides core identity capabilities.
✓ Correct choice
Real base license: Entra ID P1 adds capabilities such as Conditional Access.
✓ Correct choice
Real base license: Entra ID P2 adds capabilities such as Identity Protection and PIM entitlements.
Why this is not the answer
Invented base tier: Entra ID Premium P3 is not a documented base license tier.
Why this is not the answer
Real product: Entra ID Governance adds governance capabilities; it is not a Free/P1/P2 base-tier alternative.
The reasoning
(E exists but is an add-on, not a base tier; D does not exist)
Base tiers: Free, P1, P2. There is no P3. Entra ID Governance is an add-on covering Entitlement Management, Access Reviews, PIM for Groups, Lifecycle Workflows. Naming note: what used to be Azure AD Premium is now Entra ID Premium.
Q27
Administrative Units scope Entra role assignments to a subset of users/groups/devices. Which task can be delegated with a suitable AU-scoped role assignment?- A. Assigning a subscription Owner
- B. Resetting a password for a user who is a member of the AU
- C. Deleting an Azure resource
- D. Modifying a Conditional Access policy
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real Azure role assignment: subscription Owner belongs to Azure RBAC, outside an Entra administrative unit's scope.
✓ Correct choice
Real delegated task: an appropriate AU-scoped role can reset a member user's password, subject to role restrictions.
Why this is not the answer
Real resource operation: an Entra administrative unit does not grant Azure resource deletion rights.
Why this is not the answer
Real tenant policy: Conditional Access administration is tenant-wide, not delegated merely by AU membership.
The reasoning
An administrative unit scopes supported Microsoft Entra administrative roles to selected directory objects. For example, an AU-scoped User Administrator can reset eligible users' passwords within that unit. A tenant-scoped administrator may also have permission. Administrative units do not scope Azure resource RBAC or Conditional Access policy administration.
Q28
Which CLI command creates a new resource group ineastus?
- A.
az group new --name RG1 --region eastus - B.
az group create --name RG1 --location eastus - C.
Add-AzResourceGroup -Name RG1 -Location eastus - D.
az rg create --name RG1 --loc eastus
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Invented command form: Azure CLI uses group create and --location, not group new and --region.
✓ Correct choice
Valid Azure CLI: az group create creates a resource group using --name and --location.
Why this is not the answer
Invented cmdlet name: Azure PowerShell uses New-AzResourceGroup, not Add-AzResourceGroup.
Why this is not the answer
Invented CLI group: az rg is not the documented resource-group command group; use az group create.
The reasoning
Watch the subcommand (create, not new) and the flag (--location, not --region). PowerShell equivalent is New-AzResourceGroup (option C uses the wrong verb Add-). AZ-104 tests both CLI and PowerShell syntax; expect at least one cmdlet-recognition question.
Field anchor: you use PowerShell Az in production. Common gotcha: New- for create, Set- to set resource data and Update- to bring a resource up to date; replacement/merge behavior depends on the specific cmdlet; picking the wrong verb is worth a point.
Q29 (scenario)
Give developers the ability to deploy VMs and manage networking in ONE resource group only, without letting them grant permissions to others. Least-privileged built-in roles?- A. Owner on the RG
- B. Contributor on the RG
- C. Virtual Machine Contributor + Network Contributor on the RG
- D. User Access Administrator on the RG
Show answer & explain every option
Correct: C
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real role, too broad: Owner also allows access assignments, contrary to the requirement.
Why this is not the answer
Real role, broader than necessary: Contributor manages many resource types beyond just compute/networking.
✓ Correct choice
Real role combination: VM Contributor plus Network Contributor scopes supported compute and network operations without general role-assignment rights.
Why this is not the answer
Real access-management role: User Access Administrator manages permissions rather than the requested VM/network deployment tasks.
The reasoning
Least-privilege means the narrowest role set that accomplishes the task. Contributor is broader than needed. Owner also grants role-assignment ability, which the requirement forbids. Combining two resource-type-scoped Contributor roles is the target.
Q30
You can attach a User Assigned Managed Identity to which of the following?- A. A single VM
- B. Multiple VMs
- C. A single App Service
- D. All of the above
Show answer & explain every option
Correct: D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real attachment: a user-assigned identity can be attached to a VM; this is only one of the supported cases. This is part of the answer; the combined choice includes the other applicable statements too.
Why this is not the answer
Real reuse: one user-assigned identity can be attached to multiple supported resources, including multiple VMs. This is part of the answer; the combined choice includes the other applicable statements too.
Why this is not the answer
Real attachment: App Service supports user-assigned managed identities; this is not limited to virtual machines. This is part of the answer; the combined choice includes the other applicable statements too.
✓ Correct choice
Valid combination: all listed resource attachment patterns are supported; permissions still come from role assignments.
The reasoning
User-assigned identities are standalone resources and can be attached to many resources: VMs, VMSS, App Services, Functions, AKS, Logic Apps, and more. Storage accounts also support managed identities, including user-assigned identities for customer-managed encryption keys.
Scenario-Style Questions
Real-exam-style stems. Multi-sentence context, judgment or troubleshooting. Each has doc links so you can drill into the source.
S1
Contoso has 5 Enterprise Agreement Azure subscriptions organized under a "Corp" management group. The Security team needs Reader across all 5 subs and any future subs. Finance needs read-only access to Cost Management data on the same subs. Least-effort pattern?- A. Assign Reader to each user on each subscription individually
- B. Reader to Security group + Cost Management Reader to Finance group, both at Corp MG scope
- C. Owner to Security + Contributor to Finance at Corp scope
- D. Global Administrator to both groups
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real assignments, poor maintenance: per-user, per-subscription grants require repeated work for every user and new subscription.
✓ Correct choice
Real group-and-scope pattern: inherited Reader and Cost Management Reader assignments cover current and future subscriptions under Corp.
Why this is not the answer
Real roles, excessive privilege: Owner and Contributor allow resource changes where both teams need read access.
Why this is not the answer
Real directory role, wrong plane: Global Administrator is far broader and does not itself grant subscription resource reads.
The reasoning
Two role assignments cover all 5 subs and any added later via MG inheritance. Cost Management Reader permits cost viewing but also includes control-plane read permissions; it is not a cost-data-only custom role. Cost Management support at management-group scope depends on the billing agreement.
Docs: Cost Management Reader role | Assign roles at MG scope
S2
A developer has Contributor on RGweb-prod. They can create VMs and networks but cannot assign a secrets data-access role to a system-assigned managed identity on an RBAC-enabled Key Vault. Which additional role is sufficient without granting full resource management?
- A. Grant Owner on the Key Vault
- B. Grant User Access Administrator at the Key Vault scope
- C. Grant Global Administrator
- D. Rotate the Key Vault access keys
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real Azure role: Owner can grant access, but also permits general resource management beyond the requirement.
✓ Correct choice
Real access-management role: scoped User Access Administrator can assign the vault data role without full resource-management rights.
Why this is not the answer
Real Entra role: Global Administrator does not automatically authorize Azure role assignments on this vault.
Why this is not the answer
Incorrect mechanism: Key Vault data roles are granted through RBAC, not by rotating a storage-style vault account key.
The reasoning
An RBAC-enabled vault requires Microsoft.Authorization/roleAssignments/write to grant a data role to the managed identity. User Access Administrator provides this permission; Key Vault Secrets Officer does not manage role assignments. In the legacy access-policy model, Contributor can change access policies, which is why the original premise was incorrect.
Docs: Key Vault access policies vs RBAC | Assign RBAC to a vault
S3
Migrating hybrid users to SSPR with password writeback. Some users reset in the cloud but the new password doesn't sync to on-prem AD. First diagnostic checks?- A. Password writeback enabled in Microsoft Entra Connect and in the SSPR on-premises integration settings
- B. Password never expires set on-prem
- C. The AD DS connector account has Reset Password, Change Password, writes to lockoutTime and pwdLastSet on target users, and Unexpire Password at the domain root
- D. Both A and C
Show answer & explain every option
Correct: D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real prerequisite: writeback configuration must be enabled, but connector permissions must also be checked. This is part of the answer; the combined choice includes the other applicable statements too.
Why this is not the answer
Real AD user setting: password expiration policy does not enable password writeback or repair connector access.
Why this is not the answer
Real AD permissions: the connector needs the listed password-related rights; configuration must also be enabled. This is part of the answer; the combined choice includes the other applicable statements too.
✓ Correct choice
Valid diagnostic combination: check both cloud/writeback configuration and the connector's on-premises permissions.
The reasoning
Check both writeback configuration and the AD DS connector account permissions. Verify inheritance on affected users. Missing permissions cause writeback errors; rotating a Global Administrator password does not repair these ACLs.
Docs: How password writeback works | Enable password writeback
S4
Recommended controls for an Entra ID break-glass (emergency access) admin account?- A. Excluded from all Conditional Access, MFA not required
- B. Cloud-only emergency accounts with phishing-resistant authentication, exclusion from blocking/restrictive Conditional Access, sign-in alerts, securely stored credentials, and regular testing
- C. Password rotated monthly
- D. Federated with an external IdP
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Mixed real control and unsafe claim: avoiding blocking policies matters, but emergency accounts still require strong authentication and applicable mandatory MFA.
✓ Correct choice
Real emergency-access pattern: independent cloud accounts, strong authentication, monitoring and testing reduce reliance on a failing normal sign-in path.
Why this is not the answer
Real credential practice, incomplete: rotation alone does not supply independent access, strong authentication, alerts or regular validation.
Why this is not the answer
Real federation mechanism, fragile dependency: relying on the external identity provider can prevent emergency access during its outage.
The reasoning
Maintain at least two cloud-only emergency Global Administrator accounts, using FIDO2 passkeys or suitable certificate-based authentication. Exclude them from Conditional Access policies that could block emergency sign-in; monitor all use and validate regularly. A password-only account is not a substitute for mandatory MFA.
S5
User has PIM-eligible Global Administrator. Activation fails with "You need to satisfy authentication requirements." What's required?- A. Register MFA method and satisfy the activation requirements (MFA on activation, ticket number, justification, or approver)
- B. Assign the Reader role first
- C. Add the user to an Administrative Unit
- D. Enable Entra ID Governance
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real PIM requirements: register an accepted authentication method and meet the configured activation controls before elevation.
Why this is not the answer
Real Azure role, unrelated: Reader does not satisfy Entra PIM authentication requirements.
Why this is not the answer
Real administrative scope, unrelated: AU membership does not complete the activation challenge.
Why this is not the answer
Real governance offering, insufficient action: licensing/features do not replace completing the configured MFA and approval requirements.
The reasoning
PIM roles can require MFA on activation, business justification, ticket number, and approver. User must have registered MFA methods AND satisfy the role's activation settings. Fix: complete MFA registration and provide the justification/ticket the role requires.
Docs: PIM activate a role | PIM role settings
S6
Auditor needs to enumerate every role assignment (RBAC and Entra) across 12 subscriptions plus the tenant. Least-privileged approach?- A. Global Reader (Entra) + Reader on the Tenant Root Management Group (Azure), both assigned to the auditor group
- B. Global Administrator
- C. User Access Administrator on the tenant root
- D. Owner on each subscription
Show answer & explain every option
Listed key (under review): A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Listed key · under review
Real read-only roles: this pair covers the two permission planes. The existing question's absolute least-privilege claim remains under review.
Alternative · under review
Real directory administrator: it is overly privileged and does not itself provide Azure resource-plane access.
Alternative · under review
Real Azure access administrator: it can manage assignments, which exceeds read-only needs, and does not replace directory-read access.
Alternative · under review
Real resource administrator: Owner grants write/access rights and does not solve the separate Entra directory-read requirement.
Original explanation · under review
Global Reader is the least-privileged Entra role that can read all directory objects including role assignments. Reader at the Tenant Root MG covers Azure RBAC across all subscriptions present and future. No elevated access needed for read-only.
S7
A contractor with an M365 mailbox needs to see ONLY one resource group's resources in the Azure portal, nothing else. Setup?- A. Assign Reader on that RG only; do not assign anything at higher scope. Portal only shows resources the user has permission to see.
- B. Assign Owner on the subscription
- C. Restrict via Conditional Access
- D. Create a custom role with
Microsoft.Resources/subscriptions/readdenied
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real scoped read access: an RG-only Reader assignment limits Azure resource visibility, assuming no other inherited or direct grants.
Why this is not the answer
Real role, far too broad: subscription Owner grants control across the subscription rather than one resource group.
Why this is not the answer
Real sign-in control: Conditional Access gates authentication conditions, not the set of resource groups a role can view.
Why this is not the answer
Invalid deny design: custom-role NotActions subtracts from that role's allows; it does not create a deny assignment blocking other grants.
The reasoning
RBAC-based portal visibility: with only an RG-scoped assignment, the user's Resource Groups blade shows just that RG. No custom role or CA needed. Other RGs are simply absent from the list.
S8
Group-based licensing rollout: 30 users show "License assignment failed" for the same SKU. First check?- A. The group-license error details, including an invalid or unsupported user usage location
- B. Group membership is transitive
- C. Assign licenses individually
- D. Global Administrator role
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real diagnostic: assignment error details identify location, capacity, service-plan conflicts and dependency failures before changes are made.
Why this is not the answer
Real group relationship, not a diagnosis: nested membership is not a substitute for examining the actual license errors.
Why this is not the answer
Real manual alternative: assigning individually may reproduce the same license/location problem and abandons group lifecycle management.
Why this is not the answer
Real role, unnecessary escalation: Global Administrator is not a diagnosis for SKU assignment errors and grants excessive privilege.
The reasoning
Inspect the Errors & issues details in Microsoft 365 admin center. Invalid usage location, insufficient licenses, conflicting plans, and missing dependencies can cause failures. A user with no explicit usage location inherits the tenant location; setting each user's actual location is recommended before reprocessing.
Docs: Group-based licensing problem solving | UsageLocation attribute
S9
A DevOps pipeline uses a service principal to create App Registrations for new microservices. Least-privileged Entra role?- A. Application Developer (Entra)
- B. Cloud Application Administrator (Entra)
- C. Global Administrator
- D. Application Administrator (Entra)
Show answer & explain every option
Listed key (under review): A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Listed key · under review
Real Entra role: Application Developer supports delegated app creation; the unattended service-principal premise needs application-permission review.
Alternative · under review
Real Entra role: Cloud Application Administrator manages many applications, exceeding an own-app-only requirement.
Alternative · under review
Real directory administrator: broad tenant control is unnecessary for creating a pipeline's own applications.
Alternative · under review
Real Entra role: Application Administrator manages applications including App Proxy; it is broader than own-app creation.
Original explanation · under review
Application Developer lets a principal create App Registrations and manage the apps IT created. Cloud Application Administrator can manage all apps except App Proxy. Application Administrator adds App Proxy. Pick least-privilege: Application Developer for "creates its own apps."
S10
A Managed Application deployed via ISV creates a Deny assignment blocking ops from restarting a critical VM. Options to override for a maintenance window?- A. Owner permissions bypass Deny assignments automatically
- B. Contact the ISV to update the Managed App; delete and re-deploy with different lockdown; you cannot manually remove the Deny assignment
- C. Elevate to Global Admin and remove the Deny assignment
- D. Modify the Deny assignment via portal
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
False bypass claim: Owner is real, but an applicable deny assignment still blocks its allowed operations.
✓ Correct choice
Real owner-controlled lifecycle: use the publisher's supported management path. Replacement is disruptive and is not a routine maintenance shortcut.
Why this is not the answer
Real role, false bypass: directory elevation does not make a resource-managed deny directly removable.
Why this is not the answer
Unsupported direct edit: resource-managed deny assignments are controlled through their owning resource, not arbitrary portal edits.
The reasoning
Deny assignments from Managed Apps are managed by the Managed App resource, not editable/deletable by users regardless of role. Only the creating resource can remove them. Options: contact ISV, replace the Managed App, or manage via the ISV's supported path.
S11
Contoso invites@fabrikam.com as a B2B guest with Reader on a subscription. Can the partner see other members of your tenant?
- A. Yes, full directory visibility by default
- B. Restricted by default: guests see their own info, groups they belong to, and limited app info; not the full user list
- C. Guest sees nothing except their assigned resources
- D. Guest sees everything Global Admin sees
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
False default: ordinary guests have restricted directory permissions, not the same enumeration rights as members.
✓ Correct choice
Real default model: guests have limited directory access; tenant external-collaboration settings can restrict it further.
Why this is not the answer
Overstated restriction: resource RBAC does not erase the guest's separate default access to its own directory information.
Why this is not the answer
False privilege claim: invitation as a guest does not grant Global Administrator permissions.
The reasoning
Default guest access is Limited in Entra External Identities: guests see their own info, group memberships, and some app info, but not the full user directory. Adjustable via Entra > External Identities > External collaboration settings > Guest user access restrictions.
Docs: B2B guest permissions | External collaboration settings
S12
Apply tagEnv=Prod to 500 existing resources across 3 subscriptions. Repeatable pattern?
- A. PowerShell script that iterates and Update-AzTag on each
- B. Azure Policy with Modify effect (add or replace
Envtag) assigned at MG scope, plus remediation task - C. Manual portal edits
- D. ARM template redeployment
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real cmdlet: Update-AzTag can update resources repeatedly through scripting, but does not itself enforce ongoing policy compliance.
✓ Correct choice
Real governance pattern: a Modify assignment and remediation task update existing eligible resources and maintain the rule for later changes.
Why this is not the answer
Real operation, poor scaling: editing hundreds of resources manually is difficult to repeat and audit consistently.
Why this is not the answer
Real deployment technique: ARM can apply tags to modeled resources, but does not automatically provide cross-subscription compliance/remediation.
The reasoning
Modify + remediation is declarative, repeatable, and auditable. New resources get tagged on creation; existing resources get corrected by the remediation task. Ad-hoc PowerShell only handles one-shots.
Docs: Policy Modify effect | Tag governance
S13
Restrict new regional resources covered by the built-in Allowed locations policy to 4 approved regions across all subs, present and future. Mechanism?- A. Built-in policy "Allowed locations" assigned at Tenant Root Management Group with the
listOfAllowedLocationsparameter - B. Subscription-level lock
- C. NSG rule
- D. Custom RBAC role
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real built-in policy: a root-scope assignment inherits to descendant subscriptions, subject to the definition's documented exclusions.
Why this is not the answer
Real protection: locks prevent deletion or writes; they do not express an allowed-region list.
Why this is not the answer
Real network filter: an NSG controls packet flows, not deployment regions.
Why this is not the answer
Real authorization tool: RBAC controls permitted operations; it does not substitute for resource-property policy validation.
The reasoning
Built-in policy definition e56962a6-4747-49cd-b67b-bf8b01975c4c (Allowed locations) with Deny effect. Assign at Tenant Root MG for tenant-wide coverage inclusive of future subscriptions. The built-in definition excludes global resources and specified resource types; it does not constrain every resource without exception.
S14
Custom RBAC role: user can start, deallocate, restart VMs in one RG. Nothing else. Actions?- A.
Microsoft.Compute/virtualMachines/start/action,.../deallocate/action,.../restart/action, plusMicrosoft.Compute/virtualMachines/readandMicrosoft.Resources/subscriptions/resourceGroups/read - B.
Microsoft.Compute/ - C.
Microsoft.Authorization/ - D. Contributor
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real fine-grained actions: explicit VM lifecycle verbs plus necessary reads provide the intended operations within the assigned scope.
Why this is not the answer
Real action wildcard, too broad: Microsoft.Compute/* permits many compute changes beyond the three VM actions.
Why this is not the answer
Real authorization wildcard, wrong function: Microsoft.Authorization/* manages access/governance rather than just VM lifecycle operations.
Why this is not the answer
Real role, too broad: Contributor can create and modify many resource types beyond starting or restarting existing VMs.
The reasoning
Least-privileged custom role includes read on VMs + RGs (for portal navigation) plus the three specific action verbs. Contributor is too broad. Microsoft.Compute/* allows disk/VMSS/image modifications too.
Docs: Custom role definitions | VM contributor role reference
S15
Initiative + assignment shows a resource as non-compliant that you believe is exempted. Debug order?- A. Verify exemption scope + category + expiration; check assignment's
notScopes; check the effect of the specific policy in the initiative; force policy re-evaluation via Trigger Scan - B. Delete and recreate the initiative
- C. Grant the resource Owner
- D. Move the resource to a different subscription
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real troubleshooting path: check applicable exemption/assignment settings and refresh evaluation before changing the governance design.
Why this is not the answer
Real destructive operation, premature: recreation can disrupt other assignments without explaining a scope or expiry mistake.
Why this is not the answer
Real role, wrong fix: granting Owner changes a principal's permissions, not whether a resource is policy-exempt.
Why this is not the answer
Real move operation, disruptive: moving can alter applicable policies but is not a diagnosis or repair of the exemption.
The reasoning
Exemptions have scope, categories (Waiver or Mitigated), and expiration; all must be current. Assignment exclusions apply to the whole assignment (broader than exemption). Compliance state is not real-time; forcing evaluation refreshes.
S16
Cost Management alert on a sub with variable spend. Wants to detect unexpected spend while accounting for normal spending patterns. Config?- A. Budget at fixed dollars with static 80/100% alerts
- B. Budget with forecast-based alert at 100% + Cost Anomaly detection alert on out-of-pattern jumps
- C. Manual daily review
- D. Set the budget to zero
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real budget alerts: static thresholds detect spending levels, but do not alone identify unusual spending patterns.
✓ Correct choice
Real complementary controls: forecasts address expected budget breaches; anomaly detection highlights unexpected patterns, with processing delays.
Why this is not the answer
Real manual review: useful investigation, but not an automated forecast/anomaly alert configuration.
Why this is not the answer
Real threshold value, unhelpful: a zero budget alerts on any cost rather than distinguishing unusual patterns.
The reasoning
Use forecast-based budget alerts to detect projected budget breaches and anomaly alerts to investigate unexpected spending patterns. Neither guarantees detection of every runaway resource or absence of seasonal false positives; cost ingestion and evaluation introduce delay.
Docs: Create a budget | Cost anomaly alerts
S17
Guests count against MAU billing under Entra External Identities. Where do you see monthly guest usage?- A. Cost Management + Entra ID > Monitoring > Usage and Insights + External Identities usage report
- B. Billing portal only
- C. Not visible
- D. Guests are always free
Show answer & explain every option
Listed key (under review): A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Listed key · under review
Real reporting tools: external-identity usage and Cost Management exist; the exact report path and older per-tenant free-tier claim require review.
Alternative · under review
Real billing portal, incomplete claim: billing totals alone are not the only way to inspect identity usage.
Alternative · under review
False visibility claim: Microsoft provides external-identity usage/billing reporting.
Alternative · under review
False unlimited-free claim: free allowances and chargeable features depend on the applicable External ID billing model.
Original explanation · under review
First 50,000 MAU per tenant are free for B2B and B2C combined; beyond is billed. Usage visible in Entra ID > Monitoring > Usage and Insights, and cross-referenced in Cost Management under the Azure Active Directory service line.
Docs: External Identities billing model | Usage and insights reports
S18
Configure an organization-managed MFA policy that automatically targets administrator roles. Most maintainable path among these choices?- A. Security defaults (free but applies to all users)
- B. Conditional Access policy targeting Entra directory roles, requiring MFA (requires Entra ID P1)
- C. Per-user MFA enabled manually on each admin
- D. Enable MFA for all users
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real baseline: security defaults provide broad tenant protections, but do not offer a custom admin-role-targeted policy.
✓ Correct choice
Real targeted policy: Conditional Access can target directory roles and require MFA, subject to licensing and independent mandatory MFA rules.
Why this is not the answer
Real legacy setting: per-user MFA requires individual maintenance and does not automatically follow directory-role membership.
Why this is not the answer
Real broad requirement: all-user MFA includes administrators, but exceeds the specified role-targeted policy scope.
The reasoning
CA scoped to Entra directory roles targets admins specifically. Requires P1. Security defaults enforce MFA on everyone (broader than the requirement). Microsoft recommends Conditional Access over per-user MFA. The Authentication methods policy controls usable methods, not which users must perform MFA. Microsoft mandatory MFA can still apply independently.
Docs: CA policy require MFA for admins | Authentication methods policy
S19
New subscriptions should auto-join management group "Landing Zones" and receive default tags + policies. Mechanism?- A. Azure Landing Zones (Enterprise-Scale) via Bicep, subscription vending pattern + Default Management Group setting
- B. Manual per-sub setup
- C. Automation Runbook triggered by webhook
- D. Both A and C are valid; A is the strategic pattern
Show answer & explain every option
Correct: D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real architecture: landing zones and subscription vending apply governance consistently; default MG placement controls the initial hierarchy. This is part of the answer; the combined choice includes the other applicable statements too.
Why this is not the answer
Real manual approach: it can configure subscriptions but does not meet automatic onboarding requirements.
Why this is not the answer
Real automation building block: an authorized runbook can perform provisioning; a webhook alone does not detect new subscriptions. This is part of the answer; the combined choice includes the other applicable statements too.
✓ Correct choice
Valid qualified combination: both a designed landing-zone workflow and a properly triggered, authorized runbook can automate onboarding.
The reasoning
Default Management Group setting (Management groups > tenant root group > Settings) auto-routes new subs there. Landing Zones deliver the policy/tag pattern at the MG level via IaC. A separately configured, authorized subscription-vending automation can also move subscriptions and apply configuration; a webhook alone does not discover new subscriptions.
Docs: Enterprise-Scale Landing Zones | Default management group
S20
Policy "Require CostCenter tag" (Deny effect) is in place. Some VMs are missing the tag. How?- A. Policy was assigned AFTER those VMs were created (Deny only blocks NEW/UPDATED); or the VMs are in the assignment's
notScopes; or an exemption is active - B. Deny effect is broken
- C. VMs were created via ARM template that bypasses policy
- D. RBAC permissions are wrong
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real explanations: existing resources, assignment exclusions and exemptions can explain missing tags without a broken policy engine.
Why this is not the answer
Unsupported diagnosis: existing noncompliance alone does not prove Deny is malfunctioning.
Why this is not the answer
False bypass claim: ARM template requests are evaluated by Azure Policy; using a template does not exempt deployment.
Why this is not the answer
Real access system, wrong explanation: RBAC controls who may act, while Policy evaluates resource compliance independently.
The reasoning
Deny blocks creates and updates that violate the rule; it does not retroactively remove or fix existing resources. Existing non-compliant resources need a Modify or DeployIfNotExists policy for remediation. Templates cannot bypass policy at the ARM API layer.