Pass Your Microsoft AZ-104 Exam Easy!

'Review and correct the account's sign-in blocked state under policy' solves another task because existence and password validity are insufficient when the account is explicitly disabled for authentication. For the situation where support confuses unlocking a locked account with setting a new password, this distractor misses the requirement that unlocking login attempts and replacing a password solve different conditions and can require different controls. Unlike 'Review and correct the account's sign-in blocked state under policy', 'Check account lockout state and supported unlock workflow separately from password reset' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Enable SSPR for a selected pilot group' applies to a different feature boundary because a targeted group scope validates registration and reset behavior before any broader enablement. In the stated scenario where support confuses unlocking a locked account with setting a new password, 'Enable SSPR for a selected pilot group' does not satisfy the mechanism that unlocking login attempts and replacing a password solve different conditions and can require different controls. The necessary action is 'Check account lockout state and supported unlock workflow separately from password reset', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Validate Microsoft Entra password writeback and its hybrid prerequisites' is associated with this separate need: an employee's password is synchronized from an on-premises directory and must be changed there after SSPR. That is because cloud reset needs an authorized write-back path when on-premises AD remains password source of authority. Here support confuses unlocking a locked account with setting a new password, so 'Validate Microsoft Entra password writeback and its hybrid prerequisites' misses the fact that unlocking login attempts and replacing a password solve different conditions and can require different controls. 'Check account lockout state and supported unlock workflow separately from password reset' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When a Security Reader sees security findings but cannot change virtual network settings, the action 'Review the role's read-oriented actions rather than assuming management writes' can be relevant: security monitoring visibility is not authority to mutate arbitrary Azure resources. For the different problem of a compliance auditor must inspect resource settings but never modify them, 'Review the role's read-oriented actions rather than assuming management writes' misses the mechanism that reader provides management-plane visibility without Contributor's resource mutation rights. Choosing 'Review the role's read-oriented actions rather than assuming management writes' would address that other need, whereas 'Assign Reader at the smallest necessary resource scope' is intended to solve the stated condition.

'Assign Storage Blob Data Reader at the relevant container or account scope' applies to a different feature boundary because ARM resource reads do not automatically grant data-plane blob read actions. In the stated scenario where a compliance auditor must inspect resource settings but never modify them, 'Assign Storage Blob Data Reader at the relevant container or account scope' does not satisfy the mechanism that reader provides management-plane visibility without Contributor's resource mutation rights. The necessary action is 'Assign Reader at the smallest necessary resource scope', which should be checked against this Azure resource's actual permissions and state.

'Assign Network Contributor at an appropriately narrow scope' solves another task because Network Contributor covers network resource operations without unrelated compute administration. For the situation where a compliance auditor must inspect resource settings but never modify them, this distractor misses the requirement that reader provides management-plane visibility without Contributor's resource mutation rights. Unlike 'Assign Network Contributor at an appropriately narrow scope', 'Assign Reader at the smallest necessary resource scope' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an engineer must restart and resize VMs in one group, without management rights over unrelated networking, the action 'Assign Virtual Machine Contributor at the VM or resource-group scope as needed' can be relevant: VM Contributor targets VM operations, while some dependent resources need separate permissions. For the different problem of a compliance auditor must inspect resource settings but never modify them, 'Assign Virtual Machine Contributor at the VM or resource-group scope as needed' misses the mechanism that reader provides management-plane visibility without Contributor's resource mutation rights. Choosing 'Assign Virtual Machine Contributor at the VM or resource-group scope as needed' would address that other need, whereas 'Assign Reader at the smallest necessary resource scope' is intended to solve the stated condition.

'Assign Network Contributor at an appropriately narrow scope' applies to a different feature boundary because Network Contributor covers network resource operations without unrelated compute administration. In the stated scenario where an engineer must restart and resize VMs in one group, without management rights over unrelated networking, 'Assign Network Contributor at an appropriately narrow scope' does not satisfy the mechanism that VM Contributor targets VM operations, while some dependent resources need separate permissions. The necessary action is 'Assign Virtual Machine Contributor at the VM or resource-group scope as needed', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Use Storage Blob Data Contributor at the appropriate blob scope' is associated with this separate need: a pipeline must upload and delete blobs but cannot manage storage account networking. That is because data-plane write permissions are separate from broad account-management Contributor grants. Here an engineer must restart and resize VMs in one group, without management rights over unrelated networking, so 'Use Storage Blob Data Contributor at the appropriate blob scope' misses the fact that VM Contributor targets VM operations, while some dependent resources need separate permissions. 'Assign Virtual Machine Contributor at the VM or resource-group scope as needed' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Grant VM control on only one of the requested VMs and ignore the others' would not meet the requirement for an engineer must restart and resize VMs in one group, without management rights over unrelated networking: a grant on just one VM does not cover the multiple VMs that the engineer must operate. The intended result instead depends on VM Contributor targets VM operations, while some dependent resources need separate permissions. This option leaves the original permission, resource, or recovery condition unresolved; the correct 'Assign Virtual Machine Contributor at the VM or resource-group scope as needed' operates at the scope named by the question. Confirm the actual effect before marking the problem solved.

The nearby action 'Assign Network Contributor at an appropriately narrow scope' is associated with this separate need: a network engineer should manage VNet and NSG configurations but not VMs. That is because Network Contributor covers network resource operations without unrelated compute administration. Here a support engineer can create VMs with Contributor but cannot assign RBAC to other engineers, so 'Assign Network Contributor at an appropriately narrow scope' misses the fact that contributor normally cannot delegate resource access; IAM administration is a distinct privileged action. 'Contributor does not permit role-assignment writes; grant scoped User Access Administrator or equivalent IAM delegation rights' is the more defensible action; confirm its behavior in the target service before calling the task complete.

Assigning Contributor again does not change the role definition. Contributor permits extensive Azure resource management but excludes managing Azure role assignments, so a duplicate assignment of the same role at the same scope cannot add Microsoft.Authorization/roleAssignments/write. If the engineer actually needs to delegate access, an authorized administrator must use a distinct role that supports role-assignment operations and must scope that permission narrowly. Repeating broad resource-management grants is both unnecessary and ineffective for the precise IAM error described in the case.

When an engineer needs the same role on a different resource, not additional actions, the action 'Create or adjust the role assignment's scope rather than changing its role definition' can be relevant: the same role can be bound at different scopes; permissions within a role stay defined. For the different problem of a support engineer can create VMs with Contributor but cannot assign RBAC to other engineers, 'Create or adjust the role assignment's scope rather than changing its role definition' misses the mechanism that contributor normally cannot delegate resource access; IAM administration is a distinct privileged action. Choosing 'Create or adjust the role assignment's scope rather than changing its role definition' would address that other need, whereas 'Use User Access Administrator or a scoped role granting role-assignment rights' is intended to solve the stated condition.

The nearby action 'Assign Virtual Machine Contributor at the VM or resource-group scope as needed' is associated with this separate need: an engineer must restart and resize VMs in one group, without management rights over unrelated networking. That is because VM Contributor targets VM operations, while some dependent resources need separate permissions. Here a support engineer can create VMs with Contributor but cannot assign RBAC to other engineers, so 'Assign Virtual Machine Contributor at the VM or resource-group scope as needed' misses the fact that contributor normally cannot delegate resource access; IAM administration is a distinct privileged action. 'Contributor does not permit role-assignment writes; grant scoped User Access Administrator or equivalent IAM delegation rights' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Grant Owner at the entire subscription to simplify future VM administration' would not meet the requirement for an operator needs to restart a single VM and is requesting subscription Owner: subscription Owner grants extensive unrelated permissions, contradicting the single-VM least-privilege requirement. The intended result instead depends on owner grants RBAC delegation and broad management privileges unnecessary for one restart. This option leaves the original permission, resource, or recovery condition unresolved; the correct 'Use a narrowly scoped VM-appropriate role rather than Owner' operates at the scope named by the question. Confirm the actual effect before marking the problem solved.

'Grant Azure resource RBAC separately from Entra directory roles' applies to a different feature boundary because tenant directory administrative roles and subscription/resource management are distinct authorization systems. In the stated scenario where an operator needs to restart a single VM and is requesting subscription Owner, 'Grant Azure resource RBAC separately from Entra directory roles' does not satisfy the mechanism that owner grants RBAC delegation and broad management privileges unnecessary for one restart. The necessary action is 'Use a narrowly scoped VM-appropriate role rather than Owner', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Use Storage Blob Data Contributor at the appropriate blob scope' is associated with this separate need: a pipeline must upload and delete blobs but cannot manage storage account networking. That is because data-plane write permissions are separate from broad account-management Contributor grants. Here an operator needs to restart a single VM and is requesting subscription Owner, so 'Use Storage Blob Data Contributor at the appropriate blob scope' misses the fact that owner grants RBAC delegation and broad management privileges unnecessary for one restart. 'Use a narrowly scoped VM-appropriate role rather than Owner' is the more defensible action; confirm its behavior in the target service before calling the task complete.

A broader Reader role remains a management-plane authorization assignment. Its ability to inspect Azure Resource Manager resource metadata does not give the principal the Blob Storage DataActions required to read private object contents through an Entra-authorized blob request. Enlarging scope to the subscription exposes unrelated infrastructure without resolving the specific denied data-plane operation. Assign a dedicated read-only blob data role at the narrowest effective scope and verify the actual blob API response instead of expanding ARM visibility.

Storage Account Contributor is primarily a management-plane role and is broader than the data-only read access the analyst requires. Although some storage management privileges can support account-key operations depending on exact role actions, that is not equivalent to directly granting an Entra-authenticated Blob Data Reader permission under least privilege. The question explicitly requests a built-in role for read-only blob access using Entra authorization. A storage account management role grants unrelated administration and does not meet the intended direct data-plane role requirement.

Azure custom roles can be useful for specialized permissions, but a role defined with only generic management Actions and no blob DataActions cannot satisfy the particular Entra-authorized private blob read operation in this scenario. The prompt asks for the proper built-in read-only data role, not a new custom definition. Leaving out `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read` data permission misses the operation that is actually denied. Storage Blob Data Reader is available for this purpose at an appropriately restricted scope.

Inspecting effective permissions is a good diagnostic step, but merely reading a role definition does not grant the missing data-plane read authorization. The scenario says the analyst needs a specific built-in role for private blob content; the inspection-only alternative leaves the requested operation denied. After confirming the business need, grant Storage Blob Data Reader to the appropriate principal and scope, then validate the blob API operation. Management-plane Reader should not be treated as a substitute for the data-plane role.

The nearby action 'Assign Virtual Machine Contributor at the VM or resource-group scope as needed' is associated with this separate need: an engineer must restart and resize VMs in one group, without management rights over unrelated networking. That is because VM Contributor targets VM operations, while some dependent resources need separate permissions. Here a pipeline must upload and delete blobs but cannot manage storage account networking, so 'Assign Virtual Machine Contributor at the VM or resource-group scope as needed' misses the fact that data-plane write permissions are separate from broad account-management Contributor grants. 'Use Storage Blob Data Contributor at the appropriate blob scope' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Inspect Blob Storage DataActions independently of management Actions' solves another task because control-plane Reader cannot by itself authorize reading private object contents. For the situation where a pipeline must upload and delete blobs but cannot manage storage account networking, this distractor misses the requirement that data-plane write permissions are separate from broad account-management Contributor grants. Unlike 'Inspect Blob Storage DataActions independently of management Actions', 'Use Storage Blob Data Contributor at the appropriate blob scope' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a network engineer should manage VNet and NSG configurations but not VMs, the action 'Assign Network Contributor at an appropriately narrow scope' can be relevant: Network Contributor covers network resource operations without unrelated compute administration. For the different problem of a pipeline must upload and delete blobs but cannot manage storage account networking, 'Assign Network Contributor at an appropriately narrow scope' misses the mechanism that data-plane write permissions are separate from broad account-management Contributor grants. Choosing 'Assign Network Contributor at an appropriately narrow scope' would address that other need, whereas 'Use Storage Blob Data Contributor at the appropriate blob scope' is intended to solve the stated condition.

The nearby action 'Assign Reader at the smallest necessary resource scope' is associated with this separate need: a compliance auditor must inspect resource settings but never modify them. That is because reader provides management-plane visibility without Contributor's resource mutation rights. Here a Security Reader sees security findings but cannot change virtual network settings, so 'Assign Reader at the smallest necessary resource scope' misses the fact that security monitoring visibility is not authority to mutate arbitrary Azure resources. 'Review the role's read-oriented actions rather than assuming management writes' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Create a custom Azure role with only required actions and assign at limited scope' solves another task because custom definitions can narrow permissions but require careful allowed actions and assignable scopes. For the situation where a Security Reader sees security findings but cannot change virtual network settings, this distractor misses the requirement that security monitoring visibility is not authority to mutate arbitrary Azure resources. Unlike 'Create a custom Azure role with only required actions and assign at limited scope', 'Review the role's read-oriented actions rather than assuming management writes' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Assign Storage Blob Data Reader at the relevant container or account scope' applies to a different feature boundary because ARM resource reads do not automatically grant data-plane blob read actions. In the stated scenario where a Security Reader sees security findings but cannot change virtual network settings, 'Assign Storage Blob Data Reader at the relevant container or account scope' does not satisfy the mechanism that security monitoring visibility is not authority to mutate arbitrary Azure resources. The necessary action is 'Review the role's read-oriented actions rather than assuming management writes', which should be checked against this Azure resource's actual permissions and state.

When a compliance auditor must inspect resource settings but never modify them, the action 'Assign Reader at the smallest necessary resource scope' can be relevant: reader provides management-plane visibility without Contributor's resource mutation rights. For the different problem of a network engineer should manage VNet and NSG configurations but not VMs, 'Assign Reader at the smallest necessary resource scope' misses the mechanism that Network Contributor covers network resource operations without unrelated compute administration. Choosing 'Assign Reader at the smallest necessary resource scope' would address that other need, whereas 'Assign Network Contributor at an appropriately narrow scope' is intended to solve the stated condition.

'Use User Access Administrator or a scoped role granting role-assignment rights' applies to a different feature boundary because contributor normally cannot delegate resource access; IAM administration is a distinct privileged action. In the stated scenario where a network engineer should manage VNet and NSG configurations but not VMs, 'Use User Access Administrator or a scoped role granting role-assignment rights' does not satisfy the mechanism that Network Contributor covers network resource operations without unrelated compute administration. The necessary action is 'Assign Network Contributor at an appropriately narrow scope', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Assign Virtual Machine Contributor at the VM or resource-group scope as needed' is associated with this separate need: an engineer must restart and resize VMs in one group, without management rights over unrelated networking. That is because VM Contributor targets VM operations, while some dependent resources need separate permissions. Here a network engineer should manage VNet and NSG configurations but not VMs, so 'Assign Virtual Machine Contributor at the VM or resource-group scope as needed' misses the fact that Network Contributor covers network resource operations without unrelated compute administration. 'Assign Network Contributor at an appropriately narrow scope' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When a compliance auditor must inspect resource settings but never modify them, the action 'Assign Reader at the smallest necessary resource scope' can be relevant: reader provides management-plane visibility without Contributor's resource mutation rights. For the different problem of an application team needs only two management actions unsupported together by an appropriate built-in role, 'Assign Reader at the smallest necessary resource scope' misses the mechanism that custom definitions can narrow permissions but require careful allowed actions and assignable scopes. Choosing 'Assign Reader at the smallest necessary resource scope' would address that other need, whereas 'Create a custom Azure role with only required actions and assign at limited scope' is intended to solve the stated condition.

'Create or adjust the role assignment's scope rather than changing its role definition' applies to a different feature boundary because the same role can be bound at different scopes; permissions within a role stay defined. In the stated scenario where an application team needs only two management actions unsupported together by an appropriate built-in role, 'Create or adjust the role assignment's scope rather than changing its role definition' does not satisfy the mechanism that custom definitions can narrow permissions but require careful allowed actions and assignable scopes. The necessary action is 'Create a custom Azure role with only required actions and assign at limited scope', which should be checked against this Azure resource's actual permissions and state.

'Inspect the role definition's exact Actions, NotActions, DataActions and scope' solves another task because role names are labels; actual permitted API operations determine authorization. For the situation where an application team needs only two management actions unsupported together by an appropriate built-in role, this distractor misses the requirement that custom definitions can narrow permissions but require careful allowed actions and assignable scopes. Unlike 'Inspect the role definition's exact Actions, NotActions, DataActions and scope', 'Create a custom Azure role with only required actions and assign at limited scope' directly targets that requirement; its success must be confirmed at the authorized resource scope.

The nearby action 'Assign distinct scoped roles per subscription and principal' is associated with this separate need: two subscriptions have different approval owners and must keep access separate. That is because a management-group wide role would merge permission boundaries unnecessarily. Here a Global Reader in Entra ID cannot restart an Azure VM, so 'Assign distinct scoped roles per subscription and principal' misses the fact that tenant directory administrative roles and subscription/resource management are distinct authorization systems. 'Grant Azure resource RBAC separately from Entra directory roles' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use a narrowly scoped VM-appropriate role rather than Owner' solves another task because owner grants RBAC delegation and broad management privileges unnecessary for one restart. For the situation where a Global Reader in Entra ID cannot restart an Azure VM, this distractor misses the requirement that tenant directory administrative roles and subscription/resource management are distinct authorization systems. Unlike 'Use a narrowly scoped VM-appropriate role rather than Owner', 'Grant Azure resource RBAC separately from Entra directory roles' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a compliance auditor must inspect resource settings but never modify them, the action 'Assign Reader at the smallest necessary resource scope' can be relevant: reader provides management-plane visibility without Contributor's resource mutation rights. For the different problem of a Global Reader in Entra ID cannot restart an Azure VM, 'Assign Reader at the smallest necessary resource scope' misses the mechanism that tenant directory administrative roles and subscription/resource management are distinct authorization systems. Choosing 'Assign Reader at the smallest necessary resource scope' would address that other need, whereas 'Grant Azure resource RBAC separately from Entra directory roles' is intended to solve the stated condition.