Microsoft
AZ-104 Azure Administrator
Identities & Governance, Storage, Compute, Networking & Monitoring
Exam: AZ-104
60 Questions & Verified Answers
Domain 1: Manage Azure Identities and Governance (Q01–Q11)
Q01. You need to block creation of Azure VMs that are not tagged with a CostCenter tag. Which
Azure Policy effect should you use?
A. Audit — reports non-compliant resources but does not block creation
B. Deny — blocks the resource creation request if the CostCenter tag is absent from the
request
C. Append — automatically adds the tag with a default value
D. Modify — updates the tag after the resource is created
Answer: B. Deny — blocks the resource creation request if the CostCenter tag is absent
Policy Deny: the ARM deployment fails with a policy violation error if the tag is missing.
Audit: only reports non-compliance — does NOT prevent creation. Use Audit first to measure
impact, then switch to Deny.
Append: adds a tag if absent, does not block creation — good when you want to auto-add tags.
Assignment scope: assign the policy at subscription or management group level.
Q02. Your company needs 50 users to have Owner access to a resource group for 8 hours during
maintenance. Access must be removed automatically after 8 hours. What should you configure?
A. Add all 50 users permanently as Owners and remove them manually after 8 hours
B. Create a shared Owner service principal and distribute the client secret
C. Use Entra ID Privileged Identity Management (PIM) — configure eligible Owner
assignments with a maximum activation duration of 8 hours requiring justification
D. Create a management group with time-limited access policies
Answer: C. Entra PIM eligible assignments with 8-hour max activation and required
justification
PIM eligible: users are not active until they activate the role — reduces standing privileged access.
Activation duration: maximum 8 hours — role deactivates automatically after the configured period.
Justification required: users must enter a reason when activating — provides audit trail.
Requires: Entra ID P2 or Entra ID Governance license.
,Q03. Three departments (Finance, HR, Engineering) must manage Azure resources
independently with separate billing and no cross-access. What Azure structure BEST supports this?
A. One subscription with three resource groups separated by NSGs
B. One management group with RBAC deny assignments per department
C. Three separate Azure subscriptions (one per department) organized under a Management
Group — provides billing separation, RBAC isolation, and independent quota management
D. Three resource groups with Azure Policy preventing cross-group access
Answer: C. Three separate Azure subscriptions under a Management Group
Subscription boundary: separate billing, separate RBAC, separate resource limits per department.
Management Group: organizes subscriptions for policy and RBAC inheritance without merging
billing.
Resource groups: within one subscription — do not provide billing isolation.
Budget: each subscription can have its own Cost Management budget with separate alerts.
Q04. An external consultant with their own Microsoft account needs 30-day access to specific
Azure resources. What is the MOST appropriate approach?
A. Create a new Entra ID user account with a temporary password
B. Invite the consultant as a B2B Guest user in Entra ID and assign them the minimum
required RBAC role scoped to the specific resources
C. Share your own credentials and change the password after 30 days
D. Create a service principal and share the client secret
Answer: B. Invite as B2B Guest user in Entra ID — assign minimum RBAC role scoped to
required resources
B2B guest: consultant authenticates with their own Microsoft/Google/email account.
RBAC scope: assign the role at the resource group or resource level — not subscription level.
Access review: configure an Entra ID access review to expire guest access after 30 days
automatically.
Audit: all guest actions logged in Azure Activity Log and Entra ID sign-in logs.
Q05. A Management Group policy must not apply to one specific subscription. What is the correct
solution?
A. Delete the policy assignment from the Management Group and recreate at lower scope
B. Create a policy exemption scoped to the subscription — this excludes it from the specific
policy without removing the assignment from the Management Group
C. Override the policy by creating an opposing Deny policy at the subscription level
D. Temporarily disable the policy assignment when the exception is needed
Answer: B. Policy exemption on the subscription — excludes it without removing the
Management Group assignment
Policy exemption: scoped to the subscription, resource group, or specific resource.
Categories: Waiver (policy not applicable) or Mitigated (intent addressed by other means).
Expiration date: set an expiration for the exemption — automatically re-enforces after the date.
Exemptions: visible in the Policy Compliance dashboard with their reason and scope.
, Q06. You need to give a security team read-only access across ALL subscriptions in your
organization efficiently. What is the BEST configuration?
A. Assign Reader role on every subscription individually
B. Create a custom read-only role and assign it per subscription
C. Assign the Reader built-in role to the security team's Entra ID group at the Management
Group root level — RBAC inherits down through all subscriptions, resource groups, and
resources
D. Create a service principal and share its read-only credentials with the security team
Answer: C. Assign Reader role to the security team group at Management Group root —
inherits to all subscriptions
RBAC inheritance: assignments at Management Group propagate to ALL child subscriptions
automatically.
Group assignment: manage team membership by adding/removing users from the Entra ID group.
Reader: view all resources and configurations — cannot create, modify, or delete anything.
Future subscriptions: new subscriptions added to the Management Group automatically inherit the
assignment.
Q07. A user with Contributor role on a resource group cannot create virtual machines. What is the
MOST likely cause?
A. Contributor role does not include VM creation permissions
B. The user's account has MFA disabled
C. An Azure Policy with Deny effect is blocking VM creation — Policy Deny overrides RBAC
Allow
D. The user needs Owner role to create VMs
Answer: C. Azure Policy with Deny effect is blocking VM creation — Deny policy overrides
RBAC Allow
RBAC grants permissions. Azure Policy restricts what those permissions can do.
Policy takes precedence: a Deny policy blocks the action even if RBAC allows it.
Troubleshoot: check Azure Policy Compliance for the resource group — look for Deny assignments.
Common blocking policies: allowed VM SKUs, allowed locations, required tags.
Q08. You need to prevent accidental deletion of a critical SQL database while allowing admins to
modify its configuration. What should you apply?
A. Assign Contributor role with a delete condition exclusion
B. Apply a CanNotDelete resource lock — allows read and modify operations but blocks all
delete operations
C. Enable Microsoft Defender for SQL
D. Move the database to a subscription with restricted access
Answer: B. CanNotDelete resource lock — allows read and modify, blocks all deletes
Lock types: CanNotDelete (modify allowed, delete blocked), ReadOnly (only read allowed — too
restrictive here).
Override: even Owner cannot delete a locked resource without first removing the lock — requires
deliberate action.
Scope: apply the lock at the resource level (SQL database only) or resource group level (all
resources).
AZ-104 Azure Administrator
Identities & Governance, Storage, Compute, Networking & Monitoring
Exam: AZ-104
60 Questions & Verified Answers
Domain 1: Manage Azure Identities and Governance (Q01–Q11)
Q01. You need to block creation of Azure VMs that are not tagged with a CostCenter tag. Which
Azure Policy effect should you use?
A. Audit — reports non-compliant resources but does not block creation
B. Deny — blocks the resource creation request if the CostCenter tag is absent from the
request
C. Append — automatically adds the tag with a default value
D. Modify — updates the tag after the resource is created
Answer: B. Deny — blocks the resource creation request if the CostCenter tag is absent
Policy Deny: the ARM deployment fails with a policy violation error if the tag is missing.
Audit: only reports non-compliance — does NOT prevent creation. Use Audit first to measure
impact, then switch to Deny.
Append: adds a tag if absent, does not block creation — good when you want to auto-add tags.
Assignment scope: assign the policy at subscription or management group level.
Q02. Your company needs 50 users to have Owner access to a resource group for 8 hours during
maintenance. Access must be removed automatically after 8 hours. What should you configure?
A. Add all 50 users permanently as Owners and remove them manually after 8 hours
B. Create a shared Owner service principal and distribute the client secret
C. Use Entra ID Privileged Identity Management (PIM) — configure eligible Owner
assignments with a maximum activation duration of 8 hours requiring justification
D. Create a management group with time-limited access policies
Answer: C. Entra PIM eligible assignments with 8-hour max activation and required
justification
PIM eligible: users are not active until they activate the role — reduces standing privileged access.
Activation duration: maximum 8 hours — role deactivates automatically after the configured period.
Justification required: users must enter a reason when activating — provides audit trail.
Requires: Entra ID P2 or Entra ID Governance license.
,Q03. Three departments (Finance, HR, Engineering) must manage Azure resources
independently with separate billing and no cross-access. What Azure structure BEST supports this?
A. One subscription with three resource groups separated by NSGs
B. One management group with RBAC deny assignments per department
C. Three separate Azure subscriptions (one per department) organized under a Management
Group — provides billing separation, RBAC isolation, and independent quota management
D. Three resource groups with Azure Policy preventing cross-group access
Answer: C. Three separate Azure subscriptions under a Management Group
Subscription boundary: separate billing, separate RBAC, separate resource limits per department.
Management Group: organizes subscriptions for policy and RBAC inheritance without merging
billing.
Resource groups: within one subscription — do not provide billing isolation.
Budget: each subscription can have its own Cost Management budget with separate alerts.
Q04. An external consultant with their own Microsoft account needs 30-day access to specific
Azure resources. What is the MOST appropriate approach?
A. Create a new Entra ID user account with a temporary password
B. Invite the consultant as a B2B Guest user in Entra ID and assign them the minimum
required RBAC role scoped to the specific resources
C. Share your own credentials and change the password after 30 days
D. Create a service principal and share the client secret
Answer: B. Invite as B2B Guest user in Entra ID — assign minimum RBAC role scoped to
required resources
B2B guest: consultant authenticates with their own Microsoft/Google/email account.
RBAC scope: assign the role at the resource group or resource level — not subscription level.
Access review: configure an Entra ID access review to expire guest access after 30 days
automatically.
Audit: all guest actions logged in Azure Activity Log and Entra ID sign-in logs.
Q05. A Management Group policy must not apply to one specific subscription. What is the correct
solution?
A. Delete the policy assignment from the Management Group and recreate at lower scope
B. Create a policy exemption scoped to the subscription — this excludes it from the specific
policy without removing the assignment from the Management Group
C. Override the policy by creating an opposing Deny policy at the subscription level
D. Temporarily disable the policy assignment when the exception is needed
Answer: B. Policy exemption on the subscription — excludes it without removing the
Management Group assignment
Policy exemption: scoped to the subscription, resource group, or specific resource.
Categories: Waiver (policy not applicable) or Mitigated (intent addressed by other means).
Expiration date: set an expiration for the exemption — automatically re-enforces after the date.
Exemptions: visible in the Policy Compliance dashboard with their reason and scope.
, Q06. You need to give a security team read-only access across ALL subscriptions in your
organization efficiently. What is the BEST configuration?
A. Assign Reader role on every subscription individually
B. Create a custom read-only role and assign it per subscription
C. Assign the Reader built-in role to the security team's Entra ID group at the Management
Group root level — RBAC inherits down through all subscriptions, resource groups, and
resources
D. Create a service principal and share its read-only credentials with the security team
Answer: C. Assign Reader role to the security team group at Management Group root —
inherits to all subscriptions
RBAC inheritance: assignments at Management Group propagate to ALL child subscriptions
automatically.
Group assignment: manage team membership by adding/removing users from the Entra ID group.
Reader: view all resources and configurations — cannot create, modify, or delete anything.
Future subscriptions: new subscriptions added to the Management Group automatically inherit the
assignment.
Q07. A user with Contributor role on a resource group cannot create virtual machines. What is the
MOST likely cause?
A. Contributor role does not include VM creation permissions
B. The user's account has MFA disabled
C. An Azure Policy with Deny effect is blocking VM creation — Policy Deny overrides RBAC
Allow
D. The user needs Owner role to create VMs
Answer: C. Azure Policy with Deny effect is blocking VM creation — Deny policy overrides
RBAC Allow
RBAC grants permissions. Azure Policy restricts what those permissions can do.
Policy takes precedence: a Deny policy blocks the action even if RBAC allows it.
Troubleshoot: check Azure Policy Compliance for the resource group — look for Deny assignments.
Common blocking policies: allowed VM SKUs, allowed locations, required tags.
Q08. You need to prevent accidental deletion of a critical SQL database while allowing admins to
modify its configuration. What should you apply?
A. Assign Contributor role with a delete condition exclusion
B. Apply a CanNotDelete resource lock — allows read and modify operations but blocks all
delete operations
C. Enable Microsoft Defender for SQL
D. Move the database to a subscription with restricted access
Answer: B. CanNotDelete resource lock — allows read and modify, blocks all deletes
Lock types: CanNotDelete (modify allowed, delete blocked), ReadOnly (only read allowed — too
restrictive here).
Override: even Owner cannot delete a locked resource without first removing the lock — requires
deliberate action.
Scope: apply the lock at the resource level (SQL database only) or resource group level (all
resources).
