AZ-104 Study Notes in Questions: Manage Azure identities and governance

How well do you know Manage Azure identities and governance? This Azure Administrator – Associate (AZ-104) set has 5 questions to find out. It carries about 22.5% of the exam score. Answers and full explanations sit under each question.

Azure Administrator – Associate (AZ-104) · Manage Azure identities and governance · 5 questions with answers and explanations

🧭 What these questions look for

Expect an administrator task with a precise boundary: a role limited to one office, external users who keep their own credentials, a budget that should trigger automation, or an Owner who is still blocked. You choose the scope, identity feature or governance object that matches. Wrong options mix Microsoft Entra roles with Azure roles, or ignore a control such as a deny assignment that overrides permissions.

Tips for this set

• Before choosing where to assign a role, decide whether it is a Microsoft Entra role or an Azure role. They use different scopes, and administrative units belong only to the first.
• If someone with a powerful role is still refused, look for what overrides role assignments, such as a deny assignment from a deployment stack or a lock.
• When the same rules apply at several scopes with different values, think of a parameterized initiative assigned once per scope instead of copied definitions.

📊 This set at a glance

Exam: AZ-104 · 50 questions · 100 minutes · passing score 700
This set: 5 applied · 2 scenario, 2 troubleshooting, 1 comparison
Topics: Microsoft Cost Management, Azure Monitor action groups, Azure Automation, Microsoft Entra ID, Microsoft Entra External ID (B2B collaboration), administrative units, Azure RBAC, deployment stacks, Azure Policy

Question 1 of 5

The FinOps team created a monthly budget at the Development management group scope with email alerts. It now wants the 90% threshold to trigger an action group that runs an automation runbook to stop test VMs, but no action group option appears for this budget. What should the team do?

AEnable the spending limit on each subscription in the management group, because the spending limit stops the VMs once the budget amount is reached.

BCreate a cost anomaly alert on the management group instead, because anomaly alerts support action groups at every scope that budgets support.

CChange the budget's alerts from actual cost to forecasted cost, because only forecasted alerts can be linked to an action group in a budget.

DCreate budgets at the subscription or resource group scopes that hold the test VMs, because budget action groups are supported only at those scopes.

Show answer

✅ Answer: D

Difficulty: applied · Topic: Microsoft Cost Management, Azure Monitor action groups, Azure Automation

What budgets do
A budget in Microsoft Cost Management tracks actual cost against an amount for a monthly, quarterly or annual period and sends alerts at thresholds you choose (up to five thresholds and five email addresses), based on actual or forecasted cost. Budgets never stop resources by themselves.
• Cost data typically arrives within 8 to 24 hours, and budgets are evaluated against it every 24 hours.
• Budgets can be created at many scopes: management group, subscription, resource group, and billing scopes.

Automation through action groups
To act on a threshold (run a runbook, call a webhook or Azure Function, send a push notification), a budget calls an action group. Learn states that action groups are currently supported only for subscription and resource group scopes. A management group budget can email people but can't call an action group.

Example
For each development subscription, create a budget with a 90% actual-cost alert linked to an action group that starts a runbook to stop VMs with a given tag.

Why each option works or fails
• ✗ A. Spending limit: the spending limit applies to certain credit-based subscription offers and is not a configurable budget action; it doesn't run against a team's budget threshold.
• ✗ B. Cost anomaly alert: anomaly alerts notify about unusual spending patterns; they are not a way around the budget action group scope rule.
• ✗ C. Forecasted alerts: forecasted and actual alerts differ in what they measure, not in action group support; the scope is the restriction.
• ✓ D. Subscription or resource group budgets (correct): only budgets at those scopes can call an action group, so moving the automated alert to those scopes gives the team its runbook trigger.

Question 2 of 5

A manufacturer starts a joint project with a supplier. 300 supplier engineers must get accounts in the manufacturer's tenant, sign in with their own supplier credentials, and receive an email that tells them about the access. Which bulk operation should the User Administrator use?

ABulk restore with a CSV file of the engineers' object IDs from the supplier's tenant, which links their existing accounts into this tenant

BBulk invite with a CSV file that lists each engineer's email address and the redirection URL they reach after redeeming the invitation

CBulk create with a CSV file of the engineers' supplier email addresses, which sends each of them an invitation email after the import

DBulk create with a CSV file that lists each engineer's name, user name and initial password, and then email the passwords to the supplier

Show answer

✅ Answer: B

Difficulty: applied · Topic: Microsoft Entra ID, Microsoft Entra External ID (B2B collaboration)

Internal accounts versus B2B guests
• An internal member is created in your tenant with credentials that your tenant manages. Bulk create makes exactly these: its required columns are Name, User name (UPN in one of your domains) and Initial password. It sends no invitation emails; you have to hand out the credentials yourself.
• A B2B collaboration user is invited by email and signs in with their own organization's or identity provider's credentials. The account in your tenant gets user type Guest and a UPN like ana_supplier.com#EXT#@contoso.onmicrosoft.com.

Bulk invite
Bulk invite (Users > Bulk operations > Bulk invite) takes a CSV template in which the required values are:
• Email address to invite
• Redirection url, the page the guest lands on after accepting, such as https://myapps.microsoft.com
It can also include a customized invitation message, and invitation emails are sent to the guests.

Why each option works or fails
• ✗ A. Bulk restore: restore only brings back users deleted from this tenant within 30 days; it can't import accounts that live in another organization's tenant.
• ✓ B. Bulk invite (correct): it creates B2B guest accounts that authenticate with the engineers' own supplier credentials and sends invitation emails, which matches every requirement.
• ✗ C. Bulk create sends invitations: bulk create never sends invitations, and it needs a user name in one of the tenant's domains plus an initial password, not an external address.
• ✗ D. Bulk create with passwords: this makes internal member accounts with passwords managed by the manufacturer, so the engineers would not use their supplier credentials, and no invitation email is sent.

Question 3 of 5

Contoso wants the Busan office help desk lead to create users and reset passwords only for Busan employees, not for anyone else in the tenant. The Busan office also has its own Azure subscription for its resources. Where should the User Administrator role be assigned?

AAt the Busan subscription scope, because the Busan users were created for the resources that are held in that subscription

BAt the resource group scope of the Busan office resources, so that the role reaches only the users who work in that office

CAt an administrative unit that contains the Busan users, because Entra roles can be scoped to administrative units

DAt the scope of a management group that contains the Busan subscription, so that the role reaches all of the Busan users

Show answer

✅ Answer: C

Difficulty: applied · Topic: Microsoft Entra ID, administrative units

Where each kind of role can be scoped
• Manage: Azure roles: Azure resources; Microsoft Entra roles: directory objects (users, groups, apps)
• Scopes: Azure roles: management group, subscription, resource group, resource; Microsoft Entra roles: tenant, administrative unit, individual object
User Administrator is a Microsoft Entra role. Users are directory objects; they do not live inside a subscription or resource group, so Azure scopes do not apply to them.

Administrative units
An administrative unit is a container in Microsoft Entra ID that restricts a role's permissions to the users, groups or devices you place in it. Learn's own example is delegating help desk work to regional support staff so they manage only users in their region. Administrators scoped to an administrative unit need a Microsoft Entra ID P1 license.

Example
Create an administrative unit AU-Busan, add the Busan users to it, and assign the lead User Administrator scoped to AU-Busan.

Why each option works or fails
• ✗ A. Subscription scope: subscriptions are Azure resource scopes used by Azure roles. Users do not belong to subscriptions, and Entra roles cannot be assigned there.
• ✗ B. Resource group scope: resource groups hold Azure resources only; Entra roles such as User Administrator are never assigned at that level.
• ✓ C. Administrative unit scope (correct): Entra roles can be scoped to an administrative unit, which limits User Administrator to the users placed in that unit.
• ✗ D. Management group scope: management groups organize subscriptions for Azure RBAC and Azure Policy; they cannot scope a Microsoft Entra role.

Question 4 of 5

Hana is the subscription Owner. She tries to delete a virtual network in rg-shared and gets an authorization error. Access control (IAM) for rg-shared lists a deny assignment created by a deployment stack with DenyDelete. What explains the error, and how can it be resolved?

AOwner can delete only resources it created, so the stack owner must delete the network or transfer it to Hana as the new resource owner

BDeny assignments are removed by Hana adding a second Owner role assignment for herself directly on the virtual network resource

CDeny assignments apply only to Contributor and lower roles, so the error comes from a resource lock on rg-shared that must be removed

DDeny assignments override role assignments; change the stack's deny settings, or add Hana to its excluded principals, then delete it

Show answer

✅ Answer: D

Difficulty: applied · Topic: Azure RBAC, deployment stacks

How Azure RBAC evaluates a request
Azure Resource Manager collects every role assignment and deny assignment that applies to the resource. If a deny assignment matches the principal and the action, access is blocked, whatever roles the user holds. Only then are role assignments checked.

Who creates deny assignments
You cannot create your own deny assignments directly. In generally available scenarios Azure creates and manages them, for example:
• Deployment stacks with deny settings: DenyDelete or DenyWriteAndDelete protect the stack's managed resources against everyone unless explicitly excluded. --deny-settings-excluded-principals lists exempt principals.
• Azure managed applications.
All such deny assignments are system protected: you change them by changing the deployment stack, not by editing the deny assignment.

Seeing them
Access control (IAM) > Deny assignments shows deny assignments at the scope and inherited to it, with denied and excluded principals.

Why each option works or fails
• ✗ A. Owner only for own resources: Azure RBAC has no concept of a creator-owner; Owner applies to every resource in scope. The block comes from the deny assignment.
• ✗ B. Second Owner assignment: adding more role assignments cannot outweigh a deny assignment, because deny assignments are evaluated first and block the action.
• ✗ C. Deny only below Owner: a deny assignment applies to the listed principals regardless of their roles, Owner included. The portal already shows a deny assignment, not a lock.
• ✓ D. Deny overrides allow (correct): a deny assignment blocks the action even for an Owner. The supported fix is to update the deployment stack's deny settings, or exclude Hana's principal, and then delete the resource.

Question 5 of 5

Contoso has EU and US subsidiaries, each in its own management group. Both must enforce the same six location-related policy definitions, but each allows a different list of regions. The governance team wants to maintain the rule set once and avoid duplicate definitions. What should it do?

ACreate one initiative with an allowed-locations parameter passed to all six definitions, and assign it to each management group with its own values.

BAssign the six definitions individually at the root management group, and add each subsidiary's disallowed regions to the excluded scopes.

CAssign the six definitions at the root management group, and place ReadOnly resource locks on resource groups created in disallowed regions.

DCreate two initiatives that each contain the six definitions with their region lists hard-coded, and assign one initiative to each management group.

Show answer

✅ Answer: A

Difficulty: applied · Topic: Azure Policy

Definitions, initiatives and assignments
• A policy definition holds the rule and the effect.
• An initiative (policy set) groups several definitions so they are assigned and tracked as one unit.
• An assignment applies a definition or initiative to a scope (management group, subscription, resource group or resource) and supplies the parameter values.

Parameters pass downward
An initiative can declare its own parameter, for example init_allowedLocations, and pass it to the parameters of each member definition with [parameters('init_allowedLocations')]. The same initiative can then be assigned many times, each assignment giving a different value.

Example
One initiative "Region rules" is assigned at the EU management group with ["westeurope","northeurope"] and at the US management group with ["eastus","westus2"]. Adding a seventh rule later means editing one initiative, and both assignments pick it up.

Why each option works or fails
• ✓ A. Parameterized initiative (correct): one initiative with a shared allowed-locations parameter keeps a single rule set, and each management group assignment supplies its own region list.
• ✗ B. Exclude regions at the root: excluded scopes list management groups, subscriptions, resource groups or resources, not regions. Exclusions cannot express "different allowed regions per subsidiary".
• ✗ C. Locks on bad resource groups: locks only block changes and deletion of existing resources; they do not stop deployments in disallowed regions, and the definitions at the root would still need region values.
• ✗ D. Two hard-coded initiatives: this duplicates the rule set, so every future change has to be made twice, which is what the team wants to avoid.

🎯 What to remember

• Budgets only alert; to automate a response through an action group, the budget must be at subscription or resource group scope.
• Bulk create makes internal members with passwords and no emails; bulk invite makes B2B guests who use their own credentials and get an invitation.
• Azure roles are scoped to management groups, subscriptions, resource groups or resources; Entra roles to the tenant, administrative units or single objects.
• Deny assignments, created by Azure for features such as deployment stacks, block actions even for Owners; change the source (the stack) to lift them.
• Reuse one initiative across scopes by parameterizing it and giving each assignment its own values.

🔗 Related practice sets

• All AZ-104 practice sets
• Every exam on this blog

📚 Keep studying AZ-104

More AZ-104 questions: https://hyunhp.github.io/cert-bank/#exam=AZ-104
Study guide: https://hyunhp.github.io/cert-bank/study.html#exam=AZ-104

These are original practice questions, not real exam questions, and cert-bank is not affiliated with any certification vendor.

Original practice questions written for this blog, not exam dumps.