AZ-104 Renewal Exam
Questions and Answers
Edition
Verified Answers with Comprehensive Rationales
Microsoft Azure Administrator Associate
100 Questions | 6 Sections | Scenario-Based and Direct Recall
Aligned with 2026-2027 AZ-104 Renewal Assessment Requirements
1
,Section 1: Manage Azure Identities and Governance (20-25%)
Q1: You are the Azure Administrator for a company that uses Microsoft Entra ID (Azure AD). A user reports that
they have forgotten their password and cannot access the Azure portal. You need to ensure the user can reset their
own password. Which Microsoft Entra ID feature should you configure?
A. A. Multi-Factor Authentication (MFA)
B. B. Conditional Access policies
C. C. Self-Service Password Reset (SSPR) **[CORRECT]**
D. D. Privileged Identity Management (PIM)
Correct Answer: C
Rationale: Self-Service Password Reset (SSPR) is the correct Microsoft Entra ID feature that allows users to reset their own
passwords without contacting the helpdesk, reducing administrative overhead. Multi-Factor Authentication adds an additional
verification layer but does not enable password resets. Conditional Access policies control access conditions based on signals
like location or device compliance, not password recovery. Privileged Identity Management manages just-in-time access for
privileged roles and is unrelated to self-service password recovery for end users.
Q2: Your company has a management group named MG-Production that contains two subscriptions: Sub-A and
Sub-B. You need to assign the Reader role to a user for both subscriptions with a single assignment. At which
scope should you assign the role?
A. A. Subscription scope for each subscription individually
B. B. Management group scope on MG-Production **[CORRECT]**
C. C. Resource group scope on each resource group
D. D. Tenant scope
Correct Answer: B
Rationale: Assigning the Reader role at the management group scope (MG-Production) automatically grants read access to all
subscriptions and resource groups within that management group. This follows the RBAC scope hierarchy where permissions
flow downward: Management Group to Subscription to Resource Group to Resource. Assigning at each subscription
individually would require two separate assignments, which is less efficient. Tenant scope would grant read access to all
subscriptions in the entire tenant, which may exceed the intended scope. Resource group scope would only grant access at that
specific level and would not cover all resources in the subscriptions.
Q3: You need to prevent users from creating Azure storage accounts in the East US region within your
subscription. Which Azure Policy effect should you use?
A. A. Audit
B. B. Append
C. C. Deny **[CORRECT]**
D. D. DeployIfNotExists
Correct Answer: C
Rationale: The Deny effect is the correct Azure Policy effect to use when you need to actively block resource creation that
does not comply with your organizational standards. When a user attempts to create a storage account in the East US region,
the Deny policy will reject the request and return an error. The Audit effect would only log a warning but still allow the
creation. The Append effect adds fields to the resource during creation but cannot prevent resource creation.
DeployIfNotExists deploys required resources or configurations when a non-compliant resource is created, but it does not
prevent the initial creation.
Q4: A developer needs to upload files to an Azure Blob Storage container for 7 days. The developer should have
the minimum required permissions. Which type of Shared Access Signature (SAS) token should you create?
A. A. Account SAS with full service-level permissions
B. B. User delegation SAS with read and write permissions only **[CORRECT]**
2
, C. C. Service SAS with delete permissions included
D. D. Account SAS with object-level permissions only
Correct Answer: B
Rationale: A User Delegation SAS is secured by Microsoft Entra ID credentials and provides the most granular, least-privilege
access. It is the recommended approach for granting temporary access to blob storage because it does not require the storage
account key, reducing the risk of key compromise. An Account SAS grants broader service-level access and requires the
account key, which violates the principle of least privilege for this scenario. Including delete permissions or using full
service-level permissions would exceed the minimum requirements of uploading files for a temporary period.
Q5: You have an Azure subscription that contains a resource group named RG-App with multiple resources. You
need to ensure that no one can delete the resource group or any of its resources, but modifications to the resources
should still be allowed. Which type of resource lock should you apply?
A. A. CanNotDelete lock on the resource group **[CORRECT]**
B. B. ReadOnly lock on the resource group
C. C. CanNotDelete lock on each individual resource
D. D. ReadOnly lock on each individual resource
Correct Answer: A
Rationale: A CanNotDelete lock on the resource group prevents deletion of the resource group and all resources within it,
while still allowing modifications to the resources themselves. This lock is inherited by child resources. A ReadOnly lock
would prevent both deletion and modifications, which is too restrictive since the requirement states modifications should be
allowed. Applying CanNotDelete locks on each individual resource would be inefficient and harder to manage compared to a
single lock at the resource group level.
Q6: You are managing user licenses in Microsoft Entra ID. A user in the Sales department has been assigned a
Microsoft 365 E5 license, but they only need Microsoft 365 Business Basic features. What should you do to
optimize license usage?
A. A. Remove the user and recreate them with the correct license
B. B. Reassign the user to a Microsoft 365 Business Basic license in the Entra ID portal
**[CORRECT]**
C. C. Create a Conditional Access policy to limit the user's access
D. D. Use a group-based license assignment instead of direct assignment
Correct Answer: B
Rationale: Reassigning the user to the appropriate Microsoft 365 Business Basic license directly addresses the license
optimization requirement. In Microsoft Entra ID, administrators can change a user's license assignment from the Licenses
blade without deleting and recreating the user account. Removing and recreating the user would cause data loss and service
disruption. Conditional Access policies control access conditions but do not change the assigned license features. Group-based
licensing is a deployment strategy but does not resolve the immediate misassignment for this specific user.
Q7: Your organization uses Microsoft Entra ID with a B2B collaboration scenario. You need to add an external
user from a partner organization to access resources in your tenant. Which Entra ID feature should you use?
A. A. Dynamic groups
B. B. B2B collaboration (guest accounts) **[CORRECT]**
C. C. App registrations
D. D. Enterprise applications
Correct Answer: B
Rationale: Microsoft Entra B2B collaboration allows organizations to invite external users (guests) from partner organizations
to access resources in their tenant. The external user authenticates with their own organizational credentials, and you can
assign them roles and permissions just like internal users. Dynamic groups automatically populate based on user attributes but
are for internal users. App registrations and enterprise applications relate to application integration, not user-to-user
cross-tenant access scenarios.
3
Questions and Answers
Edition
Verified Answers with Comprehensive Rationales
Microsoft Azure Administrator Associate
100 Questions | 6 Sections | Scenario-Based and Direct Recall
Aligned with 2026-2027 AZ-104 Renewal Assessment Requirements
1
,Section 1: Manage Azure Identities and Governance (20-25%)
Q1: You are the Azure Administrator for a company that uses Microsoft Entra ID (Azure AD). A user reports that
they have forgotten their password and cannot access the Azure portal. You need to ensure the user can reset their
own password. Which Microsoft Entra ID feature should you configure?
A. A. Multi-Factor Authentication (MFA)
B. B. Conditional Access policies
C. C. Self-Service Password Reset (SSPR) **[CORRECT]**
D. D. Privileged Identity Management (PIM)
Correct Answer: C
Rationale: Self-Service Password Reset (SSPR) is the correct Microsoft Entra ID feature that allows users to reset their own
passwords without contacting the helpdesk, reducing administrative overhead. Multi-Factor Authentication adds an additional
verification layer but does not enable password resets. Conditional Access policies control access conditions based on signals
like location or device compliance, not password recovery. Privileged Identity Management manages just-in-time access for
privileged roles and is unrelated to self-service password recovery for end users.
Q2: Your company has a management group named MG-Production that contains two subscriptions: Sub-A and
Sub-B. You need to assign the Reader role to a user for both subscriptions with a single assignment. At which
scope should you assign the role?
A. A. Subscription scope for each subscription individually
B. B. Management group scope on MG-Production **[CORRECT]**
C. C. Resource group scope on each resource group
D. D. Tenant scope
Correct Answer: B
Rationale: Assigning the Reader role at the management group scope (MG-Production) automatically grants read access to all
subscriptions and resource groups within that management group. This follows the RBAC scope hierarchy where permissions
flow downward: Management Group to Subscription to Resource Group to Resource. Assigning at each subscription
individually would require two separate assignments, which is less efficient. Tenant scope would grant read access to all
subscriptions in the entire tenant, which may exceed the intended scope. Resource group scope would only grant access at that
specific level and would not cover all resources in the subscriptions.
Q3: You need to prevent users from creating Azure storage accounts in the East US region within your
subscription. Which Azure Policy effect should you use?
A. A. Audit
B. B. Append
C. C. Deny **[CORRECT]**
D. D. DeployIfNotExists
Correct Answer: C
Rationale: The Deny effect is the correct Azure Policy effect to use when you need to actively block resource creation that
does not comply with your organizational standards. When a user attempts to create a storage account in the East US region,
the Deny policy will reject the request and return an error. The Audit effect would only log a warning but still allow the
creation. The Append effect adds fields to the resource during creation but cannot prevent resource creation.
DeployIfNotExists deploys required resources or configurations when a non-compliant resource is created, but it does not
prevent the initial creation.
Q4: A developer needs to upload files to an Azure Blob Storage container for 7 days. The developer should have
the minimum required permissions. Which type of Shared Access Signature (SAS) token should you create?
A. A. Account SAS with full service-level permissions
B. B. User delegation SAS with read and write permissions only **[CORRECT]**
2
, C. C. Service SAS with delete permissions included
D. D. Account SAS with object-level permissions only
Correct Answer: B
Rationale: A User Delegation SAS is secured by Microsoft Entra ID credentials and provides the most granular, least-privilege
access. It is the recommended approach for granting temporary access to blob storage because it does not require the storage
account key, reducing the risk of key compromise. An Account SAS grants broader service-level access and requires the
account key, which violates the principle of least privilege for this scenario. Including delete permissions or using full
service-level permissions would exceed the minimum requirements of uploading files for a temporary period.
Q5: You have an Azure subscription that contains a resource group named RG-App with multiple resources. You
need to ensure that no one can delete the resource group or any of its resources, but modifications to the resources
should still be allowed. Which type of resource lock should you apply?
A. A. CanNotDelete lock on the resource group **[CORRECT]**
B. B. ReadOnly lock on the resource group
C. C. CanNotDelete lock on each individual resource
D. D. ReadOnly lock on each individual resource
Correct Answer: A
Rationale: A CanNotDelete lock on the resource group prevents deletion of the resource group and all resources within it,
while still allowing modifications to the resources themselves. This lock is inherited by child resources. A ReadOnly lock
would prevent both deletion and modifications, which is too restrictive since the requirement states modifications should be
allowed. Applying CanNotDelete locks on each individual resource would be inefficient and harder to manage compared to a
single lock at the resource group level.
Q6: You are managing user licenses in Microsoft Entra ID. A user in the Sales department has been assigned a
Microsoft 365 E5 license, but they only need Microsoft 365 Business Basic features. What should you do to
optimize license usage?
A. A. Remove the user and recreate them with the correct license
B. B. Reassign the user to a Microsoft 365 Business Basic license in the Entra ID portal
**[CORRECT]**
C. C. Create a Conditional Access policy to limit the user's access
D. D. Use a group-based license assignment instead of direct assignment
Correct Answer: B
Rationale: Reassigning the user to the appropriate Microsoft 365 Business Basic license directly addresses the license
optimization requirement. In Microsoft Entra ID, administrators can change a user's license assignment from the Licenses
blade without deleting and recreating the user account. Removing and recreating the user would cause data loss and service
disruption. Conditional Access policies control access conditions but do not change the assigned license features. Group-based
licensing is a deployment strategy but does not resolve the immediate misassignment for this specific user.
Q7: Your organization uses Microsoft Entra ID with a B2B collaboration scenario. You need to add an external
user from a partner organization to access resources in your tenant. Which Entra ID feature should you use?
A. A. Dynamic groups
B. B. B2B collaboration (guest accounts) **[CORRECT]**
C. C. App registrations
D. D. Enterprise applications
Correct Answer: B
Rationale: Microsoft Entra B2B collaboration allows organizations to invite external users (guests) from partner organizations
to access resources in their tenant. The external user authenticates with their own organizational credentials, and you can
assign them roles and permissions just like internal users. Dynamic groups automatically populate based on user attributes but
are for internal users. App registrations and enterprise applications relate to application integration, not user-to-user
cross-tenant access scenarios.
3
