Back to Azure Administrator Associate (AZ-104)

Manage Azure identities and governance

Manage Microsoft Entra users, groups, access, and subscriptions.

Covers managing Microsoft Entra users and groups, managing access to Azure resources using RBAC, and managing Azure subscriptions and governance policies.
5 minutes 5 Questions

Managing Azure identities and governance is the foundational domain of the Azure Administrator Associate (AZ-104) certification, accounting for approximately 15-20% of the exam. It focuses on securing access and maintaining control over the cloud environment through Microsoft Entra ID (formerly Azu…

Concepts covered: Manage Microsoft Entra users and groups, Manage licenses in Microsoft Entra ID, Manage external users (B2B), Configure self-service password reset (SSPR), Manage built-in Azure roles (RBAC), Assign roles at different scopes, Implement and manage Azure Policy, Configure resource locks, Apply and manage tags on resources, Manage resource groups and subscriptions, Manage costs (alerts, budgets, Azure Advisor), Configure management groups

Test mode:
Start practice test
AZ-104 - Manage Azure identities and governance Example Questions

Test your knowledge of Manage Azure identities and governance

Question 1

You apply a CanNotDelete lock to a resource group named 'RG-Finance'. An administrator with the Owner role attempts to delete a virtual machine located inside 'RG-Finance'. What is the outcome of this deletion attempt?

Correct Answer: The operation fails as the lock propagates to all resources within the group.

The correct answer is: The operation fails as the lock propagates to all resources within the group.

In Azure, management locks applied at a parent scope (such as a Resource Group) are inherited by all resources contained within that scope. Therefore, the CanNotDelete lock on 'RG-Finance' is effectively applied to the virtual machine inside it.

Crucially, management locks apply to all users, including those with the Owner role. While an Owner has the permission to create or remove locks, they cannot perform the restricted action (in this case, deletion) while the lock is still in place. The deletion attempt will be blocked by Azure Resource Manager until the lock is explicitly removed.

Why the other answers are incorrect:
- The deletion does not complete successfully because, although CanNotDelete permits read and write operations (configuration changes), it specifically prohibits deletion.
- The system does not archive resources to a recovery vault in this scenario; resource locks simply cause the API request for deletion to fail.
- The Owner role does not automatically override the lock settings; the lock enforces a restriction that supersedes RBAC permissions until the lock itself is removed.

Question 2

You administrate an Azure environment containing a resource group named 'RG-Finance'. You need to assign the Virtual Machine Contributor role to 'User1' so they can manage all current and future virtual machines within 'RG-Finance'. The solution must ensure 'User1' has no permissions on resources outside of this resource group. What is the correct scope to apply for this assignment?

Correct Answer: Apply the role assignment at the 'RG-Finance' resource group scope

The correct solution is to apply the role assignment at the 'RG-Finance' resource group scope.

In Azure Role-Based Access Control (RBAC), permissions are inherited from parent scopes to child scopes. The hierarchy is Management Group > Subscription > Resource Group > Resource.

By assigning the role at the Resource Group scope:
1. Inheritance: The user automatically gains permissions for all resources currently inside the group and any future resources created within it.
2. Isolation: The user qualifies for the specific role only within the boundaries of 'RG-Finance'. They receive no permissions for other resource groups or the subscription level, satisfying the requirement to restrict access outside of this specific group.

Why the other options are incorrect:
- Assigning the role at the subscription scope would grant the user control over virtual machines in all resource groups within the subscription, violating the 'no permissions outside of this resource group' requirement.
- Assigning the role at the management group scope would grant access across multiple subscriptions, which is far too broad.
- Assigning the role directly to each virtual machine is administratively difficult and does not automatically grant permissions for 'future' virtual machines created in the group.

Question 3

You manage the Microsoft Entra tenant for Contoso. You are initiating a collaboration with a partner company named Litware Inc. Litware does not use Microsoft Entra ID or Google, but they manage their user identities using an on-premises solution that supports the SAML 2.0 protocol. You need to ensure that Litware users can sign in to Contoso's guest resources using their existing on-premises credentials. You navigate to the External Identities blade. What should you configure to support this requirement?

Correct Answer: Configure a SAML/WS-Fed identity provider

The correct solution is to configure a SAML/WS-Fed identity provider. Microsoft Entra External Identities allows you to set up direct federation with partner organizations that use identity providers supporting the SAML 2.0 or WS-Federation protocols. Since Litware uses an on-premises solution supporting SAML 2.0 and does not have an existing Microsoft Entra tenant or Google federation, configuring a SAML/WS-Fed IdP establishes the trust relationship required for Litware users to authenticate using their own credentials.

Establishing a federation in Custom domain names is incorrect because that feature is used for federating your own domains with your own on-premises Active Directory, not for B2B guest scenarios.

Defining a connected organization in Entitlement Management helps manage access lifecycle and access packages but does not establish the underlying authentication trust with a non-Entra ID identity provider.

Creating a B2B Direct Connect inbound policy is used specifically for Microsoft Teams shared channels with other Microsoft Entra organizations, not for general B2B guest access with third-party SAML providers.

More Manage Azure identities and governance questions
357 questions (total)
Start 100 question test