Pass Your Microsoft AZ-104 Exam Easy!

Azure RBAC inheritance does not require a new standalone local assignment to be created on each descendant resource. Effective-access reporting may show inherited rights while the assignment still belongs to the parent subscription or management group. The scenario explicitly says there is no local assignment. Treating the inherited entry as an automatically created child record would send an administrator to the wrong resource for revocation.

When an employee loses access to one project but must retain access to another, the action 'Remove only the assignment granting the obsolete project scope' can be relevant: deleting every role assignment could interrupt still-approved responsibilities. For the different problem of an access report displays a user's role as inherited, but no local assignment exists, 'Remove only the assignment granting the obsolete project scope' misses the mechanism that removing a nonexistent child grant will not revoke inherited parent permissions. Choosing 'Remove only the assignment granting the obsolete project scope' would address that other need, whereas 'Trace the effective role assignment to the parent scope' is intended to solve the stated condition.

Azure RBAC normally combines applicable role grants rather than allowing a narrow child Reader assignment to revoke inherited higher privileges. Adding another local role does not cancel the parent assignment shown in effective access. To understand or remove the inherited permission, trace its origin to the ancestor where it was actually granted and follow the authorized access-removal process.

An inherited subscription or management-group role can explain unexpected permissions on a child resource, so inheritance is useful to inspect during authorization troubleshooting. It does not disambiguate two separately registered service principals that happen to display the same name. An inherited grant still references a particular principal object ID and defined scope. For this new assignment, the operator first needs to find the intended principal's Microsoft Entra object ID in the correct tenant. Changing the inheritance model cannot prevent a similarly named but different workload identity from being selected accidentally.

Assigning roles at narrower scopes is good practice when subscriptions have distinct owners or environments, but it solves a scope-isolation problem rather than principal identification. The proposed step could still grant access to the wrong application identity if the operator searches only by display name. Azure role assignments separately specify the role definition, scope, and principal ID. The question's distinguishing fact is two service principals with the same label; the stable object identifier decides which principal receives the grant, after which an appropriate scope can be selected.

A principal needs authorization such as Microsoft.Authorization/roleAssignments/write at the target scope to create role assignments. That permission governs who may create the grant; it is not a field that identifies the service principal receiving it. Even a properly authorized role administrator can assign the wrong identity if they mistake its display name for a unique identifier. Use the designated target's Microsoft Entra object ID as the `principalId`, and separately verify the operator can write assignments at the intended resource, resource group, subscription, or management-group scope.

Inspecting `Actions`, `NotActions`, `DataActions`, and assignment scope helps explain why a role permits or denies an Azure operation. It is the right diagnostic when a well-known role name masks missing API privileges. The present issue is earlier: before evaluating what the role can do, the operator must identify which of two identically named service principals should receive it. Permissions in a role definition do not disambiguate the principal. Select the precise tenant object ID, then check that the chosen role and assignment scope provide only the needed abilities.

Investigating inherited permissions is sensible during an access review, but this scenario explicitly establishes that there is no parent-scope grant and that the obsolete assignment on VM-A is still present. Leaving that assignment intact would continue to authorize the principal to inspect VM-A, contrary to the requested least-privilege separation. A scope lookup does not create an effective assignment for VM-B either. The administrator must create the correct resource-level assignment and remove the outdated one. If inherited assignments had existed, those would require their own authorized review at the actual parent scope.

The Reader role already supplies the intended read-only actions. Creating a custom role or rewriting its actions would address an incorrect permission set, not the fact that the principal is authorized for the wrong virtual machine. Even a custom role granting precisely the Reader actions would not change the scope of an existing assignment. The missing step is assigning that role to the service principal at VM-B and withdrawing the unnecessary VM-A grant, both under appropriate access-administration authority. Editing a built-in role definition is neither the safe nor supported way to accomplish this resource-scope change.

Role-assignment write authority is a prerequisite for the administrator to grant a role at VM-B, but verifying that permission does not itself alter access. The principal would still have its existing VM-A assignment and no newly authorized Reader assignment on VM-B. Removing the obsolete assignment also requires appropriate authorization to delete role assignments. Distinguish the operator’s authority to change RBAC from the access being granted to the target principal. The case asks for the actual least-privilege scope change, not a general check that the administrator is permitted to perform RBAC operations.

The role definition determines which management actions the principal could perform; the assignment scope determines which resources inherit those actions. Moving an assignment to a different scope can be appropriate after an effective-access review, but it is premature in this case because the newly assigned role might simply not have propagated to Azure Resource Manager or the client's cached token. Changing scope without evidence can create unnecessary privilege elsewhere. First refresh credentials and allow the documented propagation window, then examine the effective scope only if the request continues to fail.

Parent-scope assignments can grant inherited access to child subscriptions, resource groups and resources, so checking a parent management group can be a useful troubleshooting step when effective access appears unexpected. This scenario, however, specifies a newly granted role and stale client session as the immediate condition. A missing parent grant does not prove the new assignment is invalid: a direct assignment might be sufficient once propagated. Confirm the target assignment and refresh the session first; inspect inherited roles afterward if the effective authorization remains inconsistent.

Directly granting a VM management role on the individual VM may make a desired VM operation available, but it changes the intended access model and is not a reliable diagnosis of a freshly cached role assignment. The existing grant might already be at the right subscription or resource-group scope and simply not yet visible to the authorization service. Granting an additional role before waiting for propagation can leave excess standing permissions. Refresh the token and retest the operation with the already authorized identity before making a new grant.

When an engineer needs the same role on a different resource, not additional actions, the action 'Create or adjust the role assignment's scope rather than changing its role definition' can be relevant: the same role can be bound at different scopes; permissions within a role stay defined. For the different problem of an employee loses access to one project but must retain access to another, 'Create or adjust the role assignment's scope rather than changing its role definition' misses the mechanism that deleting every role assignment could interrupt still-approved responsibilities. Choosing 'Create or adjust the role assignment's scope rather than changing its role definition' would address that other need, whereas 'Remove only the assignment granting the obsolete project scope' is intended to solve the stated condition.

'Trace the effective role assignment to the parent scope' applies to a different feature boundary because removing a nonexistent child grant will not revoke inherited parent permissions. In the stated scenario where an employee loses access to one project but must retain access to another, 'Trace the effective role assignment to the parent scope' does not satisfy the mechanism that deleting every role assignment could interrupt still-approved responsibilities. The necessary action is 'Remove only the assignment granting the obsolete project scope', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Use an authorized identity with role-assignment write permission' is associated with this separate need: an operator has Contributor but is denied while trying to grant a team role access. That is because resource management rights do not necessarily include Microsoft.Authorization/roleAssignments/write. Here an employee loses access to one project but must retain access to another, so 'Use an authorized identity with role-assignment write permission' misses the fact that deleting every role assignment could interrupt still-approved responsibilities. 'Remove only the assignment granting the obsolete project scope' is the more defensible action; confirm its behavior in the target service before calling the task complete.

Azure RBAC role assignments are evaluated at the scope where a role is attached and at descendant scopes. Assigning Reader at RG-East cannot cause that grant to appear on RG-West or on the subscription itself. The engineer may read RG-East and resources within it, but that grant has no bearing on unrelated resource groups. Checking the role name without the role-assignment scope is therefore insufficient. To analyze effective access, list each role and the hierarchy where it applies before combining permissions at a particular target resource.

Azure RBAC does not promote a resource-level role to higher scopes or merge it with unrelated assignments. Contributor on VM-West permits supported management actions on that VM, not arbitrary VMs in RG-East. Reader on RG-East does not expand its coverage to RG-West. Even though Azure combines role permissions where multiple grants apply to one resource, that rule does not spread permissions between separate scope trees. The correct analysis identifies each assignment and where it is inherited, rather than treating all assigned roles as subscription-wide.

A narrower Reader role does not cancel a different Contributor role. At the VM-West resource, Contributor applies by its own assignment; RG-East Reader does not reach VM-West at all. Even when two allow roles overlap at a scope, Azure RBAC generally accumulates their allowed actions instead of choosing the least permissive one, subject to applicable deny assignments and other controls. This alternative both misstates Azure authorization behavior and ignores the explicitly separate resource groups in the scenario. Test effective access at each target path rather than assuming a global minimum role.

The nearby action 'Assign Reader at the smallest necessary resource scope' is associated with this separate need: a compliance auditor must inspect resource settings but never modify them. That is because reader provides management-plane visibility without Contributor's resource mutation rights. Here a user can see a storage account's ARM settings but receives a blob data read denial, so 'Assign Reader at the smallest necessary resource scope' misses the fact that control-plane Reader cannot by itself authorize reading private object contents. 'Inspect Blob Storage DataActions independently of management Actions' is the more defensible action; confirm its behavior in the target service before calling the task complete.

Management Reader over a broader scope can make additional ARM resource properties visible but does not automatically permit reading private blob contents with Microsoft Entra authorization. The failure distinguishes management Actions from storage data-plane DataActions. The reviewer should inspect or grant the appropriate data-plane capability rather than enlarging an unrelated ARM Reader assignment, which also creates excess visibility to other resources.

When a pipeline must upload and delete blobs but cannot manage storage account networking, the action 'Use Storage Blob Data Contributor at the appropriate blob scope' can be relevant: data-plane write permissions are separate from broad account-management Contributor grants. For the different problem of a user can see a storage account's ARM settings but receives a blob data read denial, 'Use Storage Blob Data Contributor at the appropriate blob scope' misses the mechanism that control-plane Reader cannot by itself authorize reading private object contents. Choosing 'Use Storage Blob Data Contributor at the appropriate blob scope' would address that other need, whereas 'Inspect Blob Storage DataActions independently of management Actions' is intended to solve the stated condition.

The nearby action 'Create or adjust the role assignment's scope rather than changing its role definition' is associated with this separate need: an engineer needs the same role on a different resource, not additional actions. That is because the same role can be bound at different scopes; permissions within a role stay defined. Here a resource operator can start a VM but cannot list or create IAM assignments, so 'Create or adjust the role assignment's scope rather than changing its role definition' misses the fact that operational permission on a VM need not include viewing or editing all role assignments. 'Check separate IAM read/write actions in the assigned role definition' is the more defensible action; confirm its behavior in the target service before calling the task complete.

Portal controls are a user interface, not an authorization guarantee. A button may remain visible while the subsequent Azure Resource Manager call is denied for lack of the required Microsoft.Authorization action or an effective role at that scope. The reviewer must inspect the actual role definition and assignment, using the denied operation details rather than assuming UI visibility proves privilege. Access to start a virtual machine is a different action, and neither an enabled button nor previous successful compute tasks automatically grants role-assignment write permission.

Granting or repeating a role that permits virtual-machine start operations does not establish the ability to write Azure RBAC assignments. Role permissions are defined by their specified management actions, and the needed IAM operation remains separate even if compute access succeeds across multiple VMs. A correct diagnosis compares the denied Microsoft.Authorization operation with the principal's effective roles at the affected scope. If role delegation is authorized, assign an appropriate scoped access-management role rather than expecting additional compute rights to turn into authorization administration.

Contributor is not a way to override a deny assignment. Reapplying a resource-management allow role cannot negate an explicit matching deny, even when the principal already has the more privileged Owner role. Here the returned evaluation identifies the exact delete operation and deny assignment. The administrator should investigate the system-managed protection and its supported lifecycle, not add a redundant grant or claim that a second allow assignment will make the denied operation succeed.

An Azure resource lock can block a deletion regardless of RBAC, but the scenario explicitly rules out a lock and supplies a different control that blocks this action. Investigating locks may be useful when the failure source is unknown; it cannot repair a positively identified deny-assignment decision. The responsible administrator must examine the deny assignment and the service controlling it, rather than changing a nonexistent resource-lock property.

An NSG controls allowed network flows to and from the VM, not ARM authorization for deleting the VM resource. Inbound management connectivity can be completely healthy while the control-plane delete request remains prohibited. The error points to a matching deny assignment on Microsoft.Compute/virtualMachines/delete; changing an NSG rule would not address that permission. It could also expose unnecessary management connectivity without affecting the denied operation.

Broadening an already sufficient allow role expands the security blast radius but does not defeat the separately evaluated deny action. The principal has Owner at the target VM, so missing grant scope is not the stated reason for failure. The returned deny assignment addresses the exact delete operation. A subscription-wide Owner grant would unnecessarily permit changes to unrelated resources while leaving the protected VM delete denied.

Azure RBAC does not give a direct Reader assignment automatic precedence over an applicable Contributor grant received through group membership. Effective allowed rights normally combine roles at the applicable resource scope, subject to separate deny restrictions. Ignoring the group-based grant would incorrectly understate what the user can modify. Evaluate all effective assignments, including group-derived access, when deciding the principal’s actual rights.

'Assign the necessary role at that resource group scope' applies to a different feature boundary because a resource-group assignment applies to its child resources without covering independent resource groups. In the stated scenario where an employee receives a direct Reader grant and a group-based Contributor grant at the same resource scope, 'Assign the necessary role at that resource group scope' does not satisfy the mechanism that direct and group assignments can accumulate at a scope; a narrow role does not override a wider grant. The necessary action is 'Evaluate the union of applicable role permissions unless a deny applies', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Identify the management-group assignment as inherited by descendant scopes' is associated with this separate need: an access report shows a grant at a management group and another directly on a resource group. That is because direct child assignments and inherited parent assignments must be traced separately. Here an employee receives a direct Reader grant and a group-based Contributor grant at the same resource scope, so 'Identify the management-group assignment as inherited by descendant scopes' misses the fact that direct and group assignments can accumulate at a scope; a narrow role does not override a wider grant. 'Evaluate the union of applicable role permissions unless a deny applies' is the more defensible action; confirm its behavior in the target service before calling the task complete.

A role assigned directly to a resource group is a local grant at that scope, not an inherited management-group assignment. By contrast, the assignment created on the parent management group applies down the hierarchy to descendant subscriptions and resource groups. Mislabeling the direct grant would confuse which administrator controls its removal. The question asks which of two observed records is inherited; the source scope is the distinguishing fact.

The nearby action 'Evaluate the union of applicable role permissions unless a deny applies' is associated with this separate need: an employee receives a direct Reader grant and a group-based Contributor grant at the same resource scope. That is because direct and group assignments can accumulate at a scope; a narrow role does not override a wider grant. Here an access report shows a grant at a management group and another directly on a resource group, so 'Evaluate the union of applicable role permissions unless a deny applies' misses the fact that direct child assignments and inherited parent assignments must be traced separately. 'Identify the management-group assignment as inherited by descendant scopes' is the more defensible action; confirm its behavior in the target service before calling the task complete.

Azure RBAC does not make parent grants disappear when a narrower child role is assigned. The inherited management-group permission remains effective wherever its scope and principal apply, alongside any legitimate local assignment, unless a separate deny or constraint intervenes. The distinction is about assignment origin, not precedence of Reader over other roles. A new child grant cannot reclassify or erase the ancestor entry.