Pass Your Microsoft AZ-104 Exam Easy!

Password writeback is a hybrid identity capability: after an authorized self-service password reset in Microsoft Entra, a synchronized user's password can be written back to an on-premises Active Directory source. The employer in the question has no on-premises AD DS and is creating a permanent employee as a cloud-managed identity. There is therefore no source directory or writeback agent to configure. Even a correctly configured hybrid reset would concern an already existing synchronized user rather than the creation of this cloud-only member account.

B2B collaboration creates a representation of an external partner in the resource tenant while the partner authenticates with their home organization or another external identity provider. This scenario identifies the subject as the startup's permanent employee, not an external supplier retaining an outside corporate identity. A guest invitation therefore selects the wrong identity lifecycle and sign-in authority. Guest access can be suitable for an actual vendor, but it does not replace creating a member user for a new employee whose account the startup must administer inside its own tenant.

A Microsoft Entra or Microsoft 365 service might require an eligible license before an employee can use that particular paid capability. But a license assignment is a later entitlement step; it does not establish a new user object or determine whether that object is cloud-managed or synchronized from on-premises AD DS. The scenario asks which identity creation path fits an organization without an on-premises directory. Create the employee as a cloud-only member first, then assess the specific licenses, group access, and service entitlements that the person's role requires.

Group-creation permissions govern whether the administrator or other users can create certain Microsoft Entra groups and can be constrained by directory roles or tenant settings. They do not decide whether the startup should create a native member identity or invite an outside guest. The employee account must exist before relevant group-based Azure RBAC, application access, or license assignments can be applied. An administrator still needs sufficient authority to create users, but troubleshooting a denied group-creation operation is not the account provisioning action requested by this case.

A managed identity is an application or Azure resource identity used by code to obtain Microsoft Entra tokens without managing a long-lived secret. A service principal is similarly a workload/security principal used by an application or automation. Neither of those entities represents this named vendor employee interacting with SharePoint through their existing corporate sign-in. Issuing a workload identity in place of a B2B user would also prevent the intended person-based access reviews and individual SharePoint permission assignments. Workload credentials are appropriate for a service-to-service integration, not ordinary human external collaboration.

External collaboration and premium access controls can have their own eligibility and billing rules; Microsoft Entra External ID B2B billing is not necessarily equivalent to assigning a full internal employee seat. Evaluating that entitlement is a necessary follow-up for whichever premium feature the business enables, but it is not the main identity-onboarding approach. The requirement is that the vendor uses their organization's credentials. A B2B invitation provides a user representation in the customer tenant while authentication stays with the external identity provider. Once invited, the vendor must still be granted the actual SharePoint site permissions.

Creating a cloud-only member gives the organization its own tenant-managed identity and a separate internal account lifecycle. That would add another set of credentials and could misrepresent the relationship as an employee rather than a business guest. The question explicitly requires the vendor to use their own organization's identity, which B2B collaboration supports through invitation and home-tenant authentication. Cloud-only members are suitable for internal staff when the organization owns their identity, not as the default answer for a partner needing restricted access to a particular SharePoint site.

This alternative introduces B2B guest onboarding even though the scenario identifies an internal set of engineers and asks which group fits shared Azure resource roles. A guest can receive Azure RBAC after invitation and the necessary authorization, but creating guest identities is not the answer to selecting the correct group type. A security group provides a stable principal whose membership can change without granting a separate role to every engineer. The required Azure RBAC role still needs a defined resource scope.

Group creation policy and directory permission checks matter when an administrator is denied the ability to create a group. No creation failure or tenant restriction is described here. Even if the operator has all group-creation privileges, that check by itself neither creates a suitable principal nor grants engineers Azure resource access. The question asks for the role-assignment group design, so a Microsoft Entra security group with a scoped Azure RBAC assignment supplies the missing mechanism. Policy restrictions can be checked during implementation if encountered.

Adding a contractor to an already existing project group can be the right membership action in a narrowly scoped external-access request, but this case describes establishing a role-assignment group for several engineers. It neither mentions a contractor nor says an appropriate project group already exists. Inserting an unrelated contractor does not select the necessary group construct, and may grant permissions to an unintended identity. Design the security group for the engineering team, then assign an appropriate resource role at the authorized scope.

Group-based licensing distributes eligible product licenses and service plans to people who are already members of a licensed group. It does not determine which employees belong to the current department group when the department field changes. Licensing may be layered on top of dynamic group membership, but configuring license inheritance alone leaves group membership administratively static. For this case, first define an attribute-driven membership rule and verify its membership transitions. Only if the department group also controls licenses would group-based licensing become a separate, subsequent entitlement decision.

Inspecting the rule expression and stored department values is an important diagnostic step when an existing dynamic group has the wrong members. It is not by itself a membership design for the stated organization, which needs ongoing automatic moves as employees change departments. A working solution must actually configure a dynamic user membership rule on a supported security group and then validate how that rule evaluates. If users can change their own department value, administrators must also address attribute-write permissions before trusting the group for sensitive access.

Manually adding a contractor to a project-scoped security group might be appropriate for a discrete assignment that has no attribute-based membership requirement. Here the people are ordinary employees who frequently change departments, so manually curated membership becomes stale after transfers and can leave obsolete access behind. A one-off project membership does not connect membership to the directory's current department attribute. A dynamic user security group is better suited to maintaining the membership population over time, subject to correct rule processing and separately authorized resource permissions.

Nested membership checks matter if a particular application or entitlement does not recognize a user through an indirect group relationship. The scenario does not present a nested-group authorization failure; it asks how to administer frequent department changes with minimal repeated manual work. Adding direct group assignments after checking nesting would not automatically track department changes. Instead, configure the attribute-based membership rule and validate the group's current members. Then, as a separate integration check, confirm that the target resource actually accepts membership in that group for its required role or policy.

Giving the operator Contributor on an Azure subscription would authorize particular Resource Manager operations at that subscription scope, not the privileged Microsoft Entra directory action for creating a role-assignable group. The failure happens before any Azure resource role assignment to a group, and the attempted group is not a subscription resource. Raising Azure permissions would increase access unnecessarily while leaving the missing Privileged Role Administrator requirement unmet. Diagnose and remedy the directory role and group-type prerequisites instead of adjusting the subscription's IAM panel.

Adding the operator as owner of an existing ordinary security group can allow some membership administration on that existing object, but it does not grant authority to create a brand-new role-assignable group. The question asks about the creation operation flagged as privileged, not managing membership of an already created group. Role-assignable groups have stricter controls because they can receive Microsoft Entra roles. The prerequisite directory administrative role remains necessary even when the operator has ownership permissions on a separate ordinary group.

Changing a new role-assignable group to dynamic membership is not a supported way around the authorization failure: Microsoft documents that groups assignable to Microsoft Entra roles do not support dynamic membership. The intended group must have the permitted membership model and must be created by a principal with Privileged Role Administrator authority. Dynamic membership rules are useful for some regular groups when the licensing and attributes support them, but they neither create the privileged group nor override its creation role requirements.

'Check group-creation policies and the operator's effective Entra permissions' applies to a different feature boundary because directory read capability does not imply permission to create every type of group under tenant policy. In the stated scenario where human resources will onboard hundreds of users from a file. Some rows lack unique user principal names, 'Check group-creation policies and the operator's effective Entra permissions' does not satisfy the mechanism that prevalidation prevents partial provisioning and duplicates; capture per-row errors rather than pretending all users exist. The necessary action is 'Validate required CSV fields and uniqueness before performing supported bulk user creation', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Use a managed identity or appropriately scoped service principal for the workload' is associated with this separate need: an unattended process must access a subscription nightly with no human interaction. That is because workloads should authenticate as applications, with scoped permissions and credentials managed rather than borrowing a person. Here human resources will onboard hundreds of users from a file. Some rows lack unique user principal names, so 'Use a managed identity or appropriately scoped service principal for the workload' misses the fact that prevalidation prevents partial provisioning and duplicates; capture per-row errors rather than pretending all users exist. 'Validate required CSV fields and uniqueness before performing supported bulk user creation' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Create a cloud-only member user in the tenant' solves another task because cloud-only members are native identities; synchronization requires an existing on-premises source and connection. For the situation where human resources will onboard hundreds of users from a file. Some rows lack unique user principal names, this distractor misses the requirement that prevalidation prevents partial provisioning and duplicates; capture per-row errors rather than pretending all users exist. Unlike 'Create a cloud-only member user in the tenant', 'Validate required CSV fields and uniqueness before performing supported bulk user creation' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Password writeback sends an authorized password change from Microsoft Entra back to a synchronized on-premises Active Directory account. The job is a machine workload on an Azure VM, has no employee password, and is not requesting hybrid-user password reset. Enabling writeback would not establish a workload identity, produce an application token, or give it permission to read the target resource group. Use a managed identity, then grant only the needed Azure resource actions at the intended scope instead of manipulating user-password recovery infrastructure.

Inviting a B2B guest is for a human or external organizational identity that needs authorized collaboration, such as access to a SharePoint site. The scenario explicitly describes a noninteractive process and prohibits using a person's stored credentials. A guest invitation neither gives the VM an Azure-hosted machine identity nor automatically grants the required Azure RBAC permission. B2B might be appropriate for a partner administrator, but this VM should authenticate using its own managed identity with a narrow resource-group role assignment.

Adding a contractor to a project security group changes membership-based access for that human or guest. It does not by itself provision an identity for code executing nightly on an Azure VM or allow the VM to request Entra access tokens without credentials. A group can be used as an RBAC assignment target in suitable designs, but the executing principal still needs its own workload identity. Enable and authorize the VM's managed identity rather than granting unrelated contractors access to the resource group.

'Invite the outside person as a Microsoft Entra B2B guest' solves another task because B2B invitation preserves external identity and requires separate resource permission after redemption. For the situation where a short-term contractor needs access to exactly one project resource through a team group, this distractor misses the requirement that group scope should follow the project requirement, not unrestricted employee or tenant access. Unlike 'Invite the outside person as a Microsoft Entra B2B guest', 'Add the contractor only to the project-scoped security group' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When employees move between departments frequently and access must follow the current department attribute, the action 'Use a dynamic user security group based on a verified department attribute' can be relevant: rule evaluation maintains membership as directory attributes change; licensing and rule syntax remain prerequisites. For the different problem of a short-term contractor needs access to exactly one project resource through a team group, 'Use a dynamic user security group based on a verified department attribute' misses the mechanism that group scope should follow the project requirement, not unrestricted employee or tenant access. Choosing 'Use a dynamic user security group based on a verified department attribute' would address that other need, whereas 'Add the contractor only to the project-scoped security group' is intended to solve the stated condition.

The nearby action 'Create an Entra security group and assign Azure RBAC to that group' is associated with this separate need: a platform team wants to assign Azure resource roles to a set of engineers, but has no Microsoft 365 collaboration need. That is because security groups are appropriate role-assignment principals; collaboration features do not establish Azure resource permissions. Here a short-term contractor needs access to exactly one project resource through a team group, so 'Create an Entra security group and assign Azure RBAC to that group' misses the fact that group scope should follow the project requirement, not unrestricted employee or tenant access. 'Add the contractor only to the project-scoped security group' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When security must stop an employee's future directory sign-ins while retaining records for an investigation, the action 'Disable the Entra user account and revoke existing sessions as authorized' can be relevant: disablement blocks new authentication without erasing the identity and audit record; revoke existing access separately. For the different problem of an employee legally changes their display name, but existing automation relies on their stable object identifier, 'Disable the Entra user account and revoke existing sessions as authorized' misses the mechanism that a display property can change while the directory object and its assignments remain the same. Choosing 'Disable the Entra user account and revoke existing sessions as authorized' would address that other need, whereas 'Change the Entra display name without replacing the user object' is intended to solve the stated condition.

The nearby action 'Change the group's owners rather than adding the person as an ordinary member' is associated with this separate need: a group needs a new person to approve membership requests, but its application members must remain unchanged. That is because group ownership and membership provide different administrative roles; do not broaden resource access as a side effect. Here an employee legally changes their display name, but existing automation relies on their stable object identifier, so 'Change the group's owners rather than adding the person as an ordinary member' misses the fact that a display property can change while the directory object and its assignments remain the same. 'Change the Entra display name without replacing the user object' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Block sign-in, revoke sessions, and remove job-related groups and assignments' solves another task because stopping future sign-in alone may not invalidate existing sessions or inherited application permissions immediately. For the situation where an employee legally changes their display name, but existing automation relies on their stable object identifier, this distractor misses the requirement that a display property can change while the directory object and its assignments remain the same. Unlike 'Block sign-in, revoke sessions, and remove job-related groups and assignments', 'Change the Entra display name without replacing the user object' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Check account lockout state and supported unlock workflow separately from password reset' applies to a different feature boundary because unlocking login attempts and replacing a password solve different conditions and can require different controls. In the stated scenario where a staff account exists but all new logins are denied despite a valid password. A blocked sign-in flag was recently set, 'Check account lockout state and supported unlock workflow separately from password reset' does not satisfy the mechanism that existence and password validity are insufficient when the account is explicitly disabled for authentication. The necessary action is 'Review and correct the account's sign-in blocked state under policy', which should be checked against this Azure resource's actual permissions and state.

Resetting a password addresses a lost or compromised secret, but the prompt identifies an explicit account-level Block sign-in setting as the cause. If that flag stays set, the tenant continues to reject new authentication despite the changed password. Self-service reset therefore cannot establish that this particular employee may sign in. Verify why the account was blocked, obtain an authorized decision on whether to restore it, and change the enabled state only when that decision permits access. A successful password-reset email is not evidence that the account's sign-in block was cleared.

When security must stop an employee's future directory sign-ins while retaining records for an investigation, the action 'Disable the Entra user account and revoke existing sessions as authorized' can be relevant: disablement blocks new authentication without erasing the identity and audit record; revoke existing access separately. For the different problem of a staff account exists but all new logins are denied despite a valid password. A blocked sign-in flag was recently set, 'Disable the Entra user account and revoke existing sessions as authorized' misses the mechanism that existence and password validity are insufficient when the account is explicitly disabled for authentication. Choosing 'Disable the Entra user account and revoke existing sessions as authorized' would address that other need, whereas 'Review and correct the account's sign-in blocked state under policy' is intended to solve the stated condition.