Microsoft AZ-104 Exam 2026 – 190 Practice Questions with Answers
& Detailed Rationales, Azure Identities & Governance, Storage,
Compute, Virtual Networking, Monitoring & Resource Management
Question 1
A company has an Azure subscription with multiple resource groups. The administrator
needs to ensure that a specific user can create and manage all resources within a single
resource group but cannot grant access to other users. Which built-in RBAC role should be
assigned?
A. Owner
B. Contributor
C. User Access Administrator
D. Reader
Correct Answer: B
Explanation: Contributor can create and manage all resources but cannot grant access to
others. Owner includes role assignment capability. User Access Administrator only manages
access, not resources. Reader is view-only.
Question 2
An administrator needs to configure self-service password reset for a group of users in
Microsoft Entra ID. The requirement states that users must verify their identity using two
methods before resetting their password. Which authentication methods configuration
satisfies this requirement?
,A. Enable only email and mobile phone methods
B. Require one method from each of two categories (e.g., email + phone)
C. Enable security questions only
D. Require administrator approval for every reset
Correct Answer: B
Explanation: SSPR authentication methods can be configured to require one or two
methods. Requiring two methods from different categories (email, phone, authenticator
app, security questions) ensures stronger identity verification before password reset.
Question 3
A global administrator needs to delegate the ability to manage user accounts (create,
modify, delete users) to a helpdesk team without granting full directory permissions. Which
Microsoft Entra ID role should be assigned?
A. Global Administrator
B. User Administrator
C. Helpdesk Administrator
D. Application Administrator
Correct Answer: B
Explanation: User Administrator can manage all aspects of users and groups, including
resetting passwords, creating users, and modifying user properties. Helpdesk Administrator
has more limited password reset capabilities.
Question 4
,An organization has configured a dynamic membership rule for a security group. Users in the
Sales department should automatically be added to the group. After creating the rule
user.department -eq "Sales", new Sales users are not appearing in the group. What is the
most likely cause?
A. Dynamic groups require Microsoft 365 licensing
B. The department attribute is not populated for the users
C. The group type must be Microsoft 365, not Security
D. Dynamic membership requires Premium P1 licensing only
Correct Answer: B
Explanation: Dynamic membership rules evaluate user attributes. If the department
attribute is empty or incorrectly formatted, users will not match the rule. The attribute must
be properly populated for dynamic membership to work.
Question 5
An administrator needs to allow external users from a partner organization to access Azure
resources. These users should authenticate using their own organizational credentials.
Which Microsoft Entra ID feature should be configured?
A. Local accounts with password sharing
B. B2B collaboration (guest users)
C. B2C tenant with social identities
D. Conditional Access with device compliance
Correct Answer: B
, Explanation: Microsoft Entra B2B collaboration allows external users to use their own work
or school accounts to access Azure resources. Guest users are invited and can authenticate
with their home organization credentials.
Question 6
An Azure Policy has been assigned at the management group level with a Deny effect for
resources without a specific tag. A resource group within that management group attempts
to create a storage account without the required tag. What happens?
A. The storage account is created but flagged as non-compliant
B. The storage account creation fails
C. The tag is automatically applied to the storage account
D. The policy is evaluated only during nightly compliance scans
Correct Answer: B
Explanation: The Deny effect blocks the creation of non-compliant resources. Azure Policy is
evaluated during resource creation (and updates), preventing resources that violate the
policy definition from being deployed.
Question 7
A company wants to ensure that resources can never be accidentally deleted, regardless of
user permissions. Which governance feature should be applied?
A. Azure Policy with Deny effect
B. Resource lock (CanNotDelete)
C. RBAC custom role denying delete
D. Management group hierarchy
& Detailed Rationales, Azure Identities & Governance, Storage,
Compute, Virtual Networking, Monitoring & Resource Management
Question 1
A company has an Azure subscription with multiple resource groups. The administrator
needs to ensure that a specific user can create and manage all resources within a single
resource group but cannot grant access to other users. Which built-in RBAC role should be
assigned?
A. Owner
B. Contributor
C. User Access Administrator
D. Reader
Correct Answer: B
Explanation: Contributor can create and manage all resources but cannot grant access to
others. Owner includes role assignment capability. User Access Administrator only manages
access, not resources. Reader is view-only.
Question 2
An administrator needs to configure self-service password reset for a group of users in
Microsoft Entra ID. The requirement states that users must verify their identity using two
methods before resetting their password. Which authentication methods configuration
satisfies this requirement?
,A. Enable only email and mobile phone methods
B. Require one method from each of two categories (e.g., email + phone)
C. Enable security questions only
D. Require administrator approval for every reset
Correct Answer: B
Explanation: SSPR authentication methods can be configured to require one or two
methods. Requiring two methods from different categories (email, phone, authenticator
app, security questions) ensures stronger identity verification before password reset.
Question 3
A global administrator needs to delegate the ability to manage user accounts (create,
modify, delete users) to a helpdesk team without granting full directory permissions. Which
Microsoft Entra ID role should be assigned?
A. Global Administrator
B. User Administrator
C. Helpdesk Administrator
D. Application Administrator
Correct Answer: B
Explanation: User Administrator can manage all aspects of users and groups, including
resetting passwords, creating users, and modifying user properties. Helpdesk Administrator
has more limited password reset capabilities.
Question 4
,An organization has configured a dynamic membership rule for a security group. Users in the
Sales department should automatically be added to the group. After creating the rule
user.department -eq "Sales", new Sales users are not appearing in the group. What is the
most likely cause?
A. Dynamic groups require Microsoft 365 licensing
B. The department attribute is not populated for the users
C. The group type must be Microsoft 365, not Security
D. Dynamic membership requires Premium P1 licensing only
Correct Answer: B
Explanation: Dynamic membership rules evaluate user attributes. If the department
attribute is empty or incorrectly formatted, users will not match the rule. The attribute must
be properly populated for dynamic membership to work.
Question 5
An administrator needs to allow external users from a partner organization to access Azure
resources. These users should authenticate using their own organizational credentials.
Which Microsoft Entra ID feature should be configured?
A. Local accounts with password sharing
B. B2B collaboration (guest users)
C. B2C tenant with social identities
D. Conditional Access with device compliance
Correct Answer: B
, Explanation: Microsoft Entra B2B collaboration allows external users to use their own work
or school accounts to access Azure resources. Guest users are invited and can authenticate
with their home organization credentials.
Question 6
An Azure Policy has been assigned at the management group level with a Deny effect for
resources without a specific tag. A resource group within that management group attempts
to create a storage account without the required tag. What happens?
A. The storage account is created but flagged as non-compliant
B. The storage account creation fails
C. The tag is automatically applied to the storage account
D. The policy is evaluated only during nightly compliance scans
Correct Answer: B
Explanation: The Deny effect blocks the creation of non-compliant resources. Azure Policy is
evaluated during resource creation (and updates), preventing resources that violate the
policy definition from being deployed.
Question 7
A company wants to ensure that resources can never be accidentally deleted, regardless of
user permissions. Which governance feature should be applied?
A. Azure Policy with Deny effect
B. Resource lock (CanNotDelete)
C. RBAC custom role denying delete
D. Management group hierarchy
