Pass Your Microsoft AZ-104 Exam Easy!

The nearby action 'Assign distinct scoped roles per subscription and principal' is associated with this separate need: two subscriptions have different approval owners and must keep access separate. That is because a management-group wide role would merge permission boundaries unnecessarily. Here a Global Reader in Entra ID cannot restart an Azure VM, so 'Assign distinct scoped roles per subscription and principal' misses the fact that tenant directory administrative roles and subscription/resource management are distinct authorization systems. 'Grant Azure resource RBAC separately from Entra directory roles' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use a narrowly scoped VM-appropriate role rather than Owner' solves another task because owner grants RBAC delegation and broad management privileges unnecessary for one restart. For the situation where a Global Reader in Entra ID cannot restart an Azure VM, this distractor misses the requirement that tenant directory administrative roles and subscription/resource management are distinct authorization systems. Unlike 'Use a narrowly scoped VM-appropriate role rather than Owner', 'Grant Azure resource RBAC separately from Entra directory roles' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a compliance auditor must inspect resource settings but never modify them, the action 'Assign Reader at the smallest necessary resource scope' can be relevant: reader provides management-plane visibility without Contributor's resource mutation rights. For the different problem of a Global Reader in Entra ID cannot restart an Azure VM, 'Assign Reader at the smallest necessary resource scope' misses the mechanism that tenant directory administrative roles and subscription/resource management are distinct authorization systems. Choosing 'Assign Reader at the smallest necessary resource scope' would address that other need, whereas 'Grant Azure resource RBAC separately from Entra directory roles' is intended to solve the stated condition.

'Check separate IAM read/write actions in the assigned role definition' solves another task because operational permission on a VM need not include viewing or editing all role assignments. For the situation where an engineer has a role with a promising display name, but an API call is denied, this distractor misses the requirement that role names are labels; actual permitted API operations determine authorization. Unlike 'Check separate IAM read/write actions in the assigned role definition', 'Inspect the role definition's exact Actions, NotActions, DataActions and scope' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an application team needs only two management actions unsupported together by an appropriate built-in role, the action 'Create a custom Azure role with only required actions and assign at limited scope' can be relevant: custom definitions can narrow permissions but require careful allowed actions and assignable scopes. For the different problem of an engineer has a role with a promising display name, but an API call is denied, 'Create a custom Azure role with only required actions and assign at limited scope' misses the mechanism that role names are labels; actual permitted API operations determine authorization. Choosing 'Create a custom Azure role with only required actions and assign at limited scope' would address that other need, whereas 'Inspect the role definition's exact Actions, NotActions, DataActions and scope' is intended to solve the stated condition.

Azure role labels are descriptive names; actual permission checks evaluate allowed Actions and DataActions in the role definition at the scope where it applies. A promising role name is insufficient to prove a rejected API call should be authorized. The effective diagnosis must inspect the required provider action and the assigned scope, accounting for NotActions and denies. Matching names alone repeats the assumption that caused the access error.

User Access Administrator is used for role-assignment delegation and related access management, not least-privilege viewing of Cost Analysis. It carries privilege to administer who can access Azure resources rather than a narrowly read-only cost function. The contractor only needs financial reporting and the prompt explicitly forbids unrelated resource-management visibility. Granting IAM delegation would create a new security risk without improving the information shown by Cost Management. A dedicated Cost Management Reader scoped to the relevant subscription is a more appropriate role for viewing cost and budget configuration.

Cost Management Contributor can view cost data, but it additionally permits managing cost configurations such as budgets, exports and shared views. The scenario asks only for financial inspection, with no authority to change budget or export settings. Choosing a contributor role would grant unnecessary cost-management write capability. Cost Management Reader offers view-only access to the cost data and configuration requested at the subscription scope while avoiding both those writes and general Azure resource viewing. The distinction is about actions included in the cost-specific role, not just whether the portal displays costs.

Azure Reader is read-only at the management plane and can view cost data for supported subscription scopes; it is not simply a wrong way to view costs. However, assigning Reader at subscription scope also exposes unrelated resource configuration, directly violating the requirement that this contractor should not see virtual-machine and other infrastructure settings. Cost Management Reader is the narrower built-in choice for this scenario. The distractor is therefore rejected for excessive resource visibility, not because Azure Reader never shows costs. Verify cost data visibility against the applicable billing scope and pricing-agreement rules.

Virtual Machine Contributor allows VM operations rather than serving as a finance reporting role. Even if a VM contributes to subscription spending, compute-management rights do not establish cost-analysis permission and needlessly permit modifying VM resources. The contractor has no deployment, start, or update responsibilities. Assigning VM Contributor would violate the stated prohibition on general infrastructure-management visibility, and would not solve the request for reports covering all services. A cost-specific read role applied to the relevant subscription is better aligned with both the scope and the requested actions.

'Use subscription-level Owner for a technician who manages one VM' would not meet the requirement for a technician maintains one database VM and no other cloud resources: unrestricted subscription Owner is not needed when the technician operates only one VM. The intended result instead depends on resource-level assignment avoids inheriting write access to unrelated resources in the group. This option leaves the original permission, resource, or recovery condition unresolved; the correct 'Assign the VM management role directly on the VM resource' operates at the scope named by the question. Confirm the actual effect before marking the problem solved.

'Remove the broad grant and assign only a scoped VM-appropriate role' applies to a different feature boundary because subscription Contributor can affect many resources far beyond the one intended VM. In the stated scenario where a technician maintains one database VM and no other cloud resources, 'Remove the broad grant and assign only a scoped VM-appropriate role' does not satisfy the mechanism that resource-level assignment avoids inheriting write access to unrelated resources in the group. The necessary action is 'Assign the VM management role directly on the VM resource', which should be checked against this Azure resource's actual permissions and state.

'Use an authorized identity with role-assignment write permission' solves another task because resource management rights do not necessarily include Microsoft.Authorization/roleAssignments/write. For the situation where a technician maintains one database VM and no other cloud resources, this distractor misses the requirement that resource-level assignment avoids inheriting write access to unrelated resources in the group. Unlike 'Use an authorized identity with role-assignment write permission', 'Assign the VM management role directly on the VM resource' directly targets that requirement; its success must be confirmed at the authorized resource scope.

The nearby action 'Assign the VM management role directly on the VM resource' is associated with this separate need: a technician maintains one database VM and no other cloud resources. That is because resource-level assignment avoids inheriting write access to unrelated resources in the group. Here a platform team operates several related services inside one resource group, not the whole subscription, so 'Assign the VM management role directly on the VM resource' misses the fact that a resource-group assignment applies to its child resources without covering independent resource groups. 'Assign the necessary role at that resource group scope' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Check for an inherited subscription or management-group RBAC assignment' solves another task because new child scopes inherit eligible roles from their existing parent scope. For the situation where a platform team operates several related services inside one resource group, not the whole subscription, this distractor misses the requirement that a resource-group assignment applies to its child resources without covering independent resource groups. Unlike 'Check for an inherited subscription or management-group RBAC assignment', 'Assign the necessary role at that resource group scope' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an access report shows a grant at a management group and another directly on a resource group, the action 'Identify the management-group assignment as inherited by descendant scopes' can be relevant: direct child assignments and inherited parent assignments must be traced separately. For the different problem of a platform team operates several related services inside one resource group, not the whole subscription, 'Identify the management-group assignment as inherited by descendant scopes' misses the mechanism that a resource-group assignment applies to its child resources without covering independent resource groups. Choosing 'Identify the management-group assignment as inherited by descendant scopes' would address that other need, whereas 'Assign the necessary role at that resource group scope' is intended to solve the stated condition.

Azure RBAC access at a resource includes inherited assignments from its ancestor management groups and subscriptions. A child role assignment cannot simply erase or override a parent-level allow. The scenario calls out an inherited permission on the subscription, so the administrator should inspect the actual parent assignment and its principal rather than treating child RBAC as an overriding restriction.

Direct assignments can explain permissions granted locally, but they cannot rule out inherited grants that originate from parent management groups. The scenario specifically states that the permission is inherited, so an audit confined to the child subscription’s local entries would miss the grant source. Inspect the management-group hierarchy and effective permissions to identify the true assignment owner.

'Assign distinct scoped roles per subscription and principal' applies to a different feature boundary because a management-group wide role would merge permission boundaries unnecessarily. In the stated scenario where a child subscription unexpectedly inherits a management grant, 'Assign distinct scoped roles per subscription and principal' does not satisfy the mechanism that management-group scoped role assignments propagate to descendant subscriptions and resources. The necessary action is 'Inspect Azure RBAC assignments at parent management groups', which should be checked against this Azure resource's actual permissions and state.

'Inspect Azure RBAC assignments at parent management groups' solves another task because management-group scoped role assignments propagate to descendant subscriptions and resources. For the situation where an intern is supposed to maintain one VM but is assigned Contributor on the entire subscription, this distractor misses the requirement that subscription Contributor can affect many resources far beyond the one intended VM. Unlike 'Inspect Azure RBAC assignments at parent management groups', 'Remove the broad grant and assign only a scoped VM-appropriate role' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Adding a VM-scoped permission while retaining the intern's subscription Contributor role leaves the original excessive permissions effective. Azure RBAC assignments are cumulative across applicable scopes, so a narrow additional grant does not cancel a broad assignment inherited at the subscription. An attacker using that identity could still modify many unrelated Azure resources. The access correction is to remove the subscription-wide Contributor assignment, assess every inherited grant, and apply a VM-appropriate management role only to the intended VM. Validate effective access after the change rather than equating a new narrow grant with least privilege.

A second VM Contributor assignment at the entire subscription remains overbroad because it applies to every VM in that subscription, not to the intern's one assigned machine. More importantly, it does not revoke the existing subscription Contributor permission; Azure RBAC still evaluates the broad assignment. The correction is to remove the overbroad grant and add the specific permitted role at the individual VM scope, accounting for inheritance and necessary dependencies. Review the access check on another VM to ensure the intern cannot manage unrelated infrastructure after remediation.

An RBAC assignment inherited from an ancestor appears in effective access even if no assignment object was created at the child resource group. Deleting a nonexistent child record cannot revoke permissions from a parent scope. The reported new resource group therefore needs an inherited-scope investigation, not a local delete action. Verify the subscription and management-group assignments and the affected principal before changing access.

'Assign the necessary role at that resource group scope' applies to a different feature boundary because a resource-group assignment applies to its child resources without covering independent resource groups. In the stated scenario where a newly deployed resource group immediately shows a particular engineer's role even though none was assigned locally, 'Assign the necessary role at that resource group scope' does not satisfy the mechanism that new child scopes inherit eligible roles from their existing parent scope. The necessary action is 'Check for an inherited subscription or management-group RBAC assignment', which should be checked against this Azure resource's actual permissions and state.

Assignments at a management group can flow through descendant subscriptions and resource groups. A newly created child does not need its own matching role entry for an inherited principal to gain the associated permissions. The premise says the role appeared without a local grant, precisely the case where inheritance should be inspected. Denying propagation would misdiagnose the effective access hierarchy.

'Assign the VM management role directly on the VM resource' applies to a different feature boundary because resource-level assignment avoids inheriting write access to unrelated resources in the group. In the stated scenario where an operator has Contributor but is denied while trying to grant a team role access, 'Assign the VM management role directly on the VM resource' does not satisfy the mechanism that resource management rights do not necessarily include Microsoft.Authorization/roleAssignments/write. The necessary action is 'Use an authorized identity with role-assignment write permission', which should be checked against this Azure resource's actual permissions and state.

'Trace the effective role assignment to the parent scope' solves another task because removing a nonexistent child grant will not revoke inherited parent permissions. For the situation where an operator has Contributor but is denied while trying to grant a team role access, this distractor misses the requirement that resource management rights do not necessarily include Microsoft.Authorization/roleAssignments/write. Unlike 'Trace the effective role assignment to the parent scope', 'Use an authorized identity with role-assignment write permission' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an engineer needs the same role on a different resource, not additional actions, the action 'Create or adjust the role assignment's scope rather than changing its role definition' can be relevant: the same role can be bound at different scopes; permissions within a role stay defined. For the different problem of an operator has Contributor but is denied while trying to grant a team role access, 'Create or adjust the role assignment's scope rather than changing its role definition' misses the mechanism that resource management rights do not necessarily include Microsoft.Authorization/roleAssignments/write. Choosing 'Create or adjust the role assignment's scope rather than changing its role definition' would address that other need, whereas 'Use an authorized identity with role-assignment write permission' is intended to solve the stated condition.

The nearby action 'Check for an inherited subscription or management-group RBAC assignment' is associated with this separate need: a newly deployed resource group immediately shows a particular engineer's role even though none was assigned locally. That is because new child scopes inherit eligible roles from their existing parent scope. Here two subscriptions have different approval owners and must keep access separate, so 'Check for an inherited subscription or management-group RBAC assignment' misses the fact that a management-group wide role would merge permission boundaries unnecessarily. 'Assign distinct scoped roles per subscription and principal' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Inspect Azure RBAC assignments at parent management groups' solves another task because management-group scoped role assignments propagate to descendant subscriptions and resources. For the situation where two subscriptions have different approval owners and must keep access separate, this distractor misses the requirement that a management-group wide role would merge permission boundaries unnecessarily. Unlike 'Inspect Azure RBAC assignments at parent management groups', 'Assign distinct scoped roles per subscription and principal' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a Global Reader in Entra ID cannot restart an Azure VM, the action 'Grant Azure resource RBAC separately from Entra directory roles' can be relevant: tenant directory administrative roles and subscription/resource management are distinct authorization systems. For the different problem of two subscriptions have different approval owners and must keep access separate, 'Grant Azure resource RBAC separately from Entra directory roles' misses the mechanism that a management-group wide role would merge permission boundaries unnecessarily. Choosing 'Grant Azure resource RBAC separately from Entra directory roles' would address that other need, whereas 'Assign distinct scoped roles per subscription and principal' is intended to solve the stated condition.

Azure RBAC inheritance does not require a new standalone local assignment to be created on each descendant resource. Effective-access reporting may show inherited rights while the assignment still belongs to the parent subscription or management group. The scenario explicitly says there is no local assignment. Treating the inherited entry as an automatically created child record would send an administrator to the wrong resource for revocation.

When an employee loses access to one project but must retain access to another, the action 'Remove only the assignment granting the obsolete project scope' can be relevant: deleting every role assignment could interrupt still-approved responsibilities. For the different problem of an access report displays a user's role as inherited, but no local assignment exists, 'Remove only the assignment granting the obsolete project scope' misses the mechanism that removing a nonexistent child grant will not revoke inherited parent permissions. Choosing 'Remove only the assignment granting the obsolete project scope' would address that other need, whereas 'Trace the effective role assignment to the parent scope' is intended to solve the stated condition.

Azure RBAC normally combines applicable role grants rather than allowing a narrow child Reader assignment to revoke inherited higher privileges. Adding another local role does not cancel the parent assignment shown in effective access. To understand or remove the inherited permission, trace its origin to the ancestor where it was actually granted and follow the authorized access-removal process.