Pass Your Microsoft AZ-104 Exam Easy!

A role assigned directly to a resource group is a local grant at that scope, not an inherited management-group assignment. By contrast, the assignment created on the parent management group applies down the hierarchy to descendant subscriptions and resource groups. Mislabeling the direct grant would confuse which administrator controls its removal. The question asks which of two observed records is inherited; the source scope is the distinguishing fact.

The nearby action 'Evaluate the union of applicable role permissions unless a deny applies' is associated with this separate need: an employee receives a direct Reader grant and a group-based Contributor grant at the same resource scope. That is because direct and group assignments can accumulate at a scope; a narrow role does not override a wider grant. Here an access report shows a grant at a management group and another directly on a resource group, so 'Evaluate the union of applicable role permissions unless a deny applies' misses the fact that direct child assignments and inherited parent assignments must be traced separately. 'Identify the management-group assignment as inherited by descendant scopes' is the more defensible action; confirm its behavior in the target service before calling the task complete.

Azure RBAC does not make parent grants disappear when a narrower child role is assigned. The inherited management-group permission remains effective wherever its scope and principal apply, alongside any legitimate local assignment, unless a separate deny or constraint intervenes. The distinction is about assignment origin, not precedence of Reader over other roles. A new child grant cannot reclassify or erase the ancestor entry.

'Viewing a portal UI does not imply permission for the underlying write operation' solves another task because read and write APIs can require different Actions and apply resource-scope checks separately. For the situation where a user can update a VM but cannot change who else has access, this distractor misses the requirement that the ability to run resource operations is not authorization to grant others roles. Unlike 'Viewing a portal UI does not imply permission for the underlying write operation', 'Require an explicitly authorized role-assignment write action' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an administrator with Contributor is unable to delete a resource protected by a CanNotDelete lock, the action 'Treat Azure resource locks separately from RBAC role permissions' can be relevant: an allowed RBAC action can be blocked by a resource lock until an authorized lock change. For the different problem of a user can update a VM but cannot change who else has access, 'Treat Azure resource locks separately from RBAC role permissions' misses the mechanism that the ability to run resource operations is not authorization to grant others roles. Choosing 'Treat Azure resource locks separately from RBAC role permissions' would address that other need, whereas 'Require an explicitly authorized role-assignment write action' is intended to solve the stated condition.

'Match the operation to its required provider action and active assignment scope' applies to a different feature boundary because a role label is not proof that a particular Microsoft.Resources action is allowed. In the stated scenario where a user can update a VM but cannot change who else has access, 'Match the operation to its required provider action and active assignment scope' does not satisfy the mechanism that the ability to run resource operations is not authorization to grant others roles. The necessary action is 'Require an explicitly authorized role-assignment write action', which should be checked against this Azure resource's actual permissions and state.

'Require an explicitly authorized role-assignment write action' solves another task because the ability to run resource operations is not authorization to grant others roles. For the situation where an administrator with Contributor is unable to delete a resource protected by a CanNotDelete lock, this distractor misses the requirement that an allowed RBAC action can be blocked by a resource lock until an authorized lock change. Unlike 'Require an explicitly authorized role-assignment write action', 'Treat Azure resource locks separately from RBAC role permissions' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an engineer has Reader on one resource group and Contributor on one specific VM elsewhere, the action 'Combine applicable role grants only at their respective effective scopes' can be relevant: role permissions can accumulate where assignments apply; not all roles grant across all resources. For the different problem of an administrator with Contributor is unable to delete a resource protected by a CanNotDelete lock, 'Combine applicable role grants only at their respective effective scopes' misses the mechanism that an allowed RBAC action can be blocked by a resource lock until an authorized lock change. Choosing 'Combine applicable role grants only at their respective effective scopes' would address that other need, whereas 'Treat Azure resource locks separately from RBAC role permissions' is intended to solve the stated condition.

The nearby action 'Evaluate the union of applicable role permissions unless a deny applies' is associated with this separate need: an employee receives a direct Reader grant and a group-based Contributor grant at the same resource scope. That is because direct and group assignments can accumulate at a scope; a narrow role does not override a wider grant. Here an administrator with Contributor is unable to delete a resource protected by a CanNotDelete lock, so 'Evaluate the union of applicable role permissions unless a deny applies' misses the fact that an allowed RBAC action can be blocked by a resource lock until an authorized lock change. 'Treat Azure resource locks separately from RBAC role permissions' is the more defensible action; confirm its behavior in the target service before calling the task complete.

A role name is not the authorization policy itself. The caller may lack the particular resource provider action required by deployment or may have a role assigned outside the resource’s effective scope. Therefore, looking only at the display name repeats the assumption the scenario warns about. Compare the API operation to role Actions, NotActions and any relevant scope or deny, then decide whether a scoped change is actually needed.

The nearby action 'Inspect deny assignments and relevant policy or lock restrictions' is associated with this separate need: a principal has a broad role but a particular management operation is still denied. That is because allow grants are not the only access constraints; effective authorization also considers denies. Here an API denies a deployment despite a broad-sounding assigned role, so 'Inspect deny assignments and relevant policy or lock restrictions' misses the fact that a role label is not proof that a particular Microsoft.Resources action is allowed. 'Match the operation to its required provider action and active assignment scope' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Require an explicitly authorized role-assignment write action' solves another task because the ability to run resource operations is not authorization to grant others roles. For the situation where an API denies a deployment despite a broad-sounding assigned role, this distractor misses the requirement that a role label is not proof that a particular Microsoft.Resources action is allowed. Unlike 'Require an explicitly authorized role-assignment write action', 'Match the operation to its required provider action and active assignment scope' directly targets that requirement; its success must be confirmed at the authorized resource scope.

The nearby action 'Remove only the assignment granting the obsolete project scope' is associated with this separate need: an employee loses access to one project but must retain access to another. That is because deleting every role assignment could interrupt still-approved responsibilities. Here after revoking access, an old token appears to retain some authority temporarily, so 'Remove only the assignment granting the obsolete project scope' misses the fact that revocation may not take instantaneous effect across all clients; monitor effective access. 'Allow for RBAC propagation and token/cache lifetime while enforcing urgent containment' is the more defensible action; confirm its behavior in the target service before calling the task complete.

Azure role and token evaluation may include cached credentials or propagation delays, so an already issued client token can appear to retain authority briefly after a role is removed. The scenario is specifically concerned with this transient window after revocation. Operations should verify effective access and use containment measures appropriate to the urgency, not assume that the moment of assignment deletion proves every downstream session has lost rights.

When a principal has a broad role but a particular management operation is still denied, the action 'Inspect deny assignments and relevant policy or lock restrictions' can be relevant: allow grants are not the only access constraints; effective authorization also considers denies. For the different problem of after revoking access, an old token appears to retain some authority temporarily, 'Inspect deny assignments and relevant policy or lock restrictions' misses the mechanism that revocation may not take instantaneous effect across all clients; monitor effective access. Choosing 'Inspect deny assignments and relevant policy or lock restrictions' would address that other need, whereas 'Allow for RBAC propagation and token/cache lifetime while enforcing urgent containment' is intended to solve the stated condition.

Microsoft.Authorization/roleAssignments/write controls the creation of Azure RBAC assignments, not the Microsoft.Compute operation that saves a VM setting. A principal could be permitted to manage assignments without automatically having the separate permissions for the resource modification being attempted. The error explicitly names Microsoft.Compute/virtualMachines/write, so asking for access-delegation permissions would miss the denied resource action and could unnecessarily expand privilege. Instead, an authorized administrator should grant the narrowly scoped VM management rights required for this approved change, then confirm effective assignments and any deny controls.

The Azure portal uses read operations to show a VM and its configuration. Those successful reads do not grant the provider write action used when the operator selects Save. In this case the service returned an AuthorizationFailed naming the VM write action, which is stronger evidence than the availability of an editing control in a UI. A portal bug is not the supported conclusion merely because the blade appeared editable. Compare the principal’s effective role definitions, scopes and any denials before retrying the update.

An Azure role assignment at a resource-group scope normally applies to resources within that group through inherited RBAC scope. A principal does not have to receive every applicable role directly on each VM for the role’s permitted actions to be effective. Here the problem is the absence of Microsoft.Compute/virtualMachines/write in the operator’s effective rights, not the mere possibility that a group-scoped assignment might be used. A supported VM-management grant at the correct scope can resolve the denied save, assuming no other deny assignment or policy separately blocks it.

'Use a modify policy with a suitable managed identity and role permissions for remediation' solves another task because modify changes supported properties at request time; existing resources may require remediation tasks. For the situation where a team wants to see policy violations without blocking new deployments, this distractor misses the requirement that audit records noncompliance but does not automatically reject matching resource requests. Unlike 'Use a modify policy with a suitable managed identity and role permissions for remediation', 'Assign an audit effect rather than deny' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When several regulatory controls must be tracked and applied together, the action 'Group related policy definitions into an initiative and assign it' can be relevant: an initiative combines multiple definitions for consistent assignment and compliance reporting. For the different problem of a team wants to see policy violations without blocking new deployments, 'Group related policy definitions into an initiative and assign it' misses the mechanism that audit records noncompliance but does not automatically reject matching resource requests. Choosing 'Group related policy definitions into an initiative and assign it' would address that other need, whereas 'Assign an audit effect rather than deny' is intended to solve the stated condition.

The nearby action 'Create a justified, scoped, expiring exemption rather than weakening the global definition' is associated with this separate need: a development subscription needs a time-limited exception to one policy standard. That is because an exemption preserves governance outside the temporary exception and leaves an audit trail. Here a team wants to see policy violations without blocking new deployments, so 'Create a justified, scoped, expiring exemption rather than weakening the global definition' misses the fact that audit records noncompliance but does not automatically reject matching resource requests. 'Assign an audit effect rather than deny' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Review compliance result and remediation, not assume enforcement removed the existing resource' solves another task because audit/evaluation flags existing resources; request-time deny is not retrospective deletion. For the situation where a team wants to see policy violations without blocking new deployments, this distractor misses the requirement that audit records noncompliance but does not automatically reject matching resource requests. Unlike 'Review compliance result and remediation, not assume enforcement removed the existing resource', 'Assign an audit effect rather than deny' directly targets that requirement; its success must be confirmed at the authorized resource scope.

The Audit effect evaluates and reports noncompliant resources but does not itself modify missing tags on existing deployed resources. A compliance dashboard may show the missing cost-center value without causing any resource write. To add or update tags under an approved policy, use a supported modify effect with the assignment's managed identity authorized for the necessary operation and create a remediation task for existing resources. Verify the tags after remediation rather than treating an Audit result as evidence the missing cost-center metadata was automatically repaired.

'Grant the policy assignment's managed identity the needed target-scope deployment role' applies to a different feature boundary because compliance detection alone does not grant rights to deploy dependent resources during remediation. In the stated scenario where resources need a missing cost-center tag to be added under an approved remediation policy, 'Grant the policy assignment's managed identity the needed target-scope deployment role' does not satisfy the mechanism that modify changes supported properties at request time; existing resources may require remediation tasks. The necessary action is 'Use a modify policy with a suitable managed identity and role permissions for remediation', which should be checked against this Azure resource's actual permissions and state.

'Review compliance result and remediation, not assume enforcement removed the existing resource' solves another task because audit/evaluation flags existing resources; request-time deny is not retrospective deletion. For the situation where resources need a missing cost-center tag to be added under an approved remediation policy, this distractor misses the requirement that modify changes supported properties at request time; existing resources may require remediation tasks. Unlike 'Review compliance result and remediation, not assume enforcement removed the existing resource', 'Use a modify policy with a suitable managed identity and role permissions for remediation' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Assign at the intended scope with explicit exclusion or documented exemption' applies to a different feature boundary because an appropriate assignment scope prevents policy applying to unrelated environments. In the stated scenario where a deployIfNotExists policy evaluates a VM but cannot create its required diagnostic setting, 'Assign at the intended scope with explicit exclusion or documented exemption' does not satisfy the mechanism that compliance detection alone does not grant rights to deploy dependent resources during remediation. The necessary action is 'Grant the policy assignment's managed identity the needed target-scope deployment role', which should be checked against this Azure resource's actual permissions and state.

'Review compliance result and remediation, not assume enforcement removed the existing resource' solves another task because audit/evaluation flags existing resources; request-time deny is not retrospective deletion. For the situation where a deployIfNotExists policy evaluates a VM but cannot create its required diagnostic setting, this distractor misses the requirement that compliance detection alone does not grant rights to deploy dependent resources during remediation. Unlike 'Review compliance result and remediation, not assume enforcement removed the existing resource', 'Grant the policy assignment's managed identity the needed target-scope deployment role' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When several regulatory controls must be tracked and applied together, the action 'Group related policy definitions into an initiative and assign it' can be relevant: an initiative combines multiple definitions for consistent assignment and compliance reporting. For the different problem of a deployIfNotExists policy evaluates a VM but cannot create its required diagnostic setting, 'Group related policy definitions into an initiative and assign it' misses the mechanism that compliance detection alone does not grant rights to deploy dependent resources during remediation. Choosing 'Group related policy definitions into an initiative and assign it' would address that other need, whereas 'Grant the policy assignment's managed identity the needed target-scope deployment role' is intended to solve the stated condition.

Audit evaluates and reports compliance but does not create or repair a missing diagnostic resource. Even a deployIfNotExists policy needs the required managed identity and role permissions to perform the deployment action. The question states that evaluation occurred but resource creation failed. Making the policy detective-only would eliminate the remediation mechanism rather than solve the permission failure. Supply an appropriately scoped deployment role to the assignment identity.

The nearby action 'Grant the policy assignment's managed identity the needed target-scope deployment role' is associated with this separate need: a deployIfNotExists policy evaluates a VM but cannot create its required diagnostic setting. That is because compliance detection alone does not grant rights to deploy dependent resources during remediation. Here an existing VM becomes noncompliant after a policy is assigned, so 'Grant the policy assignment's managed identity the needed target-scope deployment role' misses the fact that audit/evaluation flags existing resources; request-time deny is not retrospective deletion. 'Review compliance result and remediation, not assume enforcement removed the existing resource' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use a modify policy with a suitable managed identity and role permissions for remediation' solves another task because modify changes supported properties at request time; existing resources may require remediation tasks. For the situation where an existing VM becomes noncompliant after a policy is assigned, this distractor misses the requirement that audit/evaluation flags existing resources; request-time deny is not retrospective deletion. Unlike 'Use a modify policy with a suitable managed identity and role permissions for remediation', 'Review compliance result and remediation, not assume enforcement removed the existing resource' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Assign an audit effect rather than deny' applies to a different feature boundary because audit records noncompliance but does not automatically reject matching resource requests. In the stated scenario where an existing VM becomes noncompliant after a policy is assigned, 'Assign an audit effect rather than deny' does not satisfy the mechanism that audit/evaluation flags existing resources; request-time deny is not retrospective deletion. The necessary action is 'Review compliance result and remediation, not assume enforcement removed the existing resource', which should be checked against this Azure resource's actual permissions and state.

Assigning permissions to a policy managed identity can enable modify or deployIfNotExists remediation operations, but it does not change which resources the assignment evaluates. Contributor is also unnecessarily broad and not a mechanism to exclude a lab from the compliance denominator. The laboratory remains a descendant of the policy assignment until an explicit exclusion or different appropriate scope configuration is applied. The requirement concerns the assignment boundary, not remediation identity privileges. Configure the laboratory as a notScopes excluded subscription while retaining the desired production evaluation scope.

Moving resources between resource groups within the same laboratory subscription does not remove that subscription from a policy assigned above it at the management-group scope. Azure Policy assignment coverage follows the defined hierarchy and exclusions, not an assumption that a new group name signifies nonproduction. With no notScopes entry, applicable laboratory resources can continue to be evaluated and appear in compliance results. To satisfy the stated permanent removal from evaluation, modify the assignment exclusion list or hierarchy deliberately; rearranging resources inside the same covered subscription is insufficient.

Azure Policy exemptions are designed for documented waivers or mitigations and can have an expiry, but exempted resources remain represented as Exempted in compliance reporting. This violates the question’s explicit requirement that the permanent laboratory exception not appear as Exempted or be counted as evaluated. A time-limited exemption would additionally require renewal and approval after expiration. Microsoft recommends broad, permanent bypasses through assignment exclusions using notScopes, reserving exemptions for tracked temporary or specific deviations. Both are valid features generally, but only notScopes meets this precise reporting and duration constraint.