I85PREP
⌘ K
Azure AZ-104 study materials
Azure AZ-104 study resources

Azure AZ-104 practice questions

One question at a time. Build your Azure AZ-104 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Manage Azure identities and governance

Which Microsoft Entra built-in role can create and delete users and reset passwords for non-administrator users, while granting the least privilege needed for those tasks?

  1. Helpdesk Administrator
  2. Global Administrator
  3. User Administrator Correct answer.
  4. Privileged Role Administrator

Explanation

User Administrator can create and manage users and can reset passwords for non-administrator users, which matches the required tasks with the least privilege. Global Administrator is broader than needed, and Helpdesk Administrator cannot create users.

Question 2Manage Azure identities and governance

At which scopes can an Azure RBAC role assignment be created?

  1. Only the subscription and resource group levels
  2. Management group, subscription, resource group, or resource Correct answer.
  3. Only the individual resource and subscription levels
  4. Only the tenant root management group and its subscriptions

Explanation

Role assignments can be applied at a management group, a subscription, a resource group, or an individual resource, and lower scopes inherit assignments made higher in the hierarchy.

Question 3Manage Azure identities and governance

Which lock level prevents users from both modifying and deleting a resource?

  1. ReadOnly Correct answer.
  2. NoWrite
  3. CanNotDelete
  4. Delete

Explanation

A ReadOnly lock allows read operations only, so it blocks both updates and deletions. CanNotDelete blocks only deletion while still permitting modifications.

Question 4Manage Azure identities and governance

You apply tags to a resource group. What happens to the existing resources in that group?

  1. The tags are copied to resources only when the resource group has no locks
  2. Tags are not inherited by the resources in the group Correct answer.
  3. The tags are copied only to resources created after the tags were applied
  4. The tags are copied to each resource automatically

Explanation

Tags are not inherited from a resource group to the resources inside it. To propagate tags you must tag each resource, for example with an Azure Policy assignment that uses the modify effect and a remediation task.

Question 5Manage Azure identities and governance

You plan to delete a management group that contains three subscriptions. What must you do first?

  1. Move the subscriptions to another management group Correct answer.
  2. Assign the Owner role on the tenant root group
  3. Convert the subscriptions into resource groups
  4. Remove all resource locks from the subscriptions

Explanation

A management group can be deleted only when it contains no child management groups or subscriptions. Moving the subscriptions elsewhere empties the group so it can be removed.

Question 6Manage Azure identities and governance

Which group membership type lets you add members by using a rule that evaluates user attributes?

  1. Dynamic Device
  2. Microsoft 365
  3. Assigned
  4. Dynamic User Correct answer.

Explanation

A dynamic user group uses a membership rule that evaluates user attributes such as department or country, and membership updates automatically as attributes change. Assigned groups require manual membership management.

Question 7Manage Azure identities and governance

Which Azure construct serves as the billing and administrative boundary for resources?

  1. Subscription Correct answer.
  2. Resource group
  3. Directory
  4. Management group

Explanation

A subscription is the unit of billing and the primary administrative boundary for Azure resources. Resource groups organize resources inside a subscription, and management groups organize subscriptions.

Question 8Manage Azure identities and governance

A partner organization's employee needs to access resources by signing in with their own email address. Which user type should you create?

  1. Guest Correct answer.
  2. Member
  3. Service principal
  4. Managed identity

Explanation

Guest users are external identities invited into the directory through business-to-business collaboration and authenticate with their own credentials. Member accounts are for identities owned by your directory.

Question 9Manage Azure identities and governance

A user must be able to manage virtual machines in resource group RG1 and must not be able to grant access to anyone. You need to assign the least privileged role. What should you assign?

  1. Owner on RG1
  2. User Access Administrator on RG1
  3. Contributor on the subscription
  4. Virtual Machine Contributor on RG1 Correct answer.

Explanation

Virtual Machine Contributor grants management of virtual machines without the ability to manage access. Owner and User Access Administrator both include permission to create role assignments, which violates the requirement.

Question 10Manage Azure identities and governance

Which Azure Policy effect blocks the creation or update of a resource that violates the policy rule?

  1. Audit
  2. DeployIfNotExists
  3. Append
  4. Deny Correct answer.

Explanation

The Deny effect causes the resource request to fail when the resource does not meet the policy condition. Audit only records non-compliance, and Append and DeployIfNotExists alter or add to the request rather than rejecting it.

Question 11Manage Azure identities and governance

Which property of a custom Azure RBAC role definition lists the control-plane operations that the role permits?

  1. NotActions
  2. AssignableScopes
  3. Actions Correct answer.
  4. DataActions

Explanation

Actions lists the control-plane operations the role allows, while NotActions subtracts from that list. DataActions applies to data-plane operations, and AssignableScopes controls where the role can be assigned.

Question 12Manage Azure identities and governance

Which feature provides time-bound activation of privileged directory roles, optionally requiring approval and justification?

  1. Entitlement management with access packages
  2. Privileged Identity Management Correct answer.
  3. Access reviews for directory roles
  4. Conditional Access with authentication strength

Explanation

Privileged Identity Management makes users eligible for a role and requires them to activate it for a limited period, optionally with approval, justification, and multi-factor authentication. It reduces standing privileged access.

Question 13Manage Azure identities and governance

What is the main purpose of an access review in Microsoft Entra ID?

  1. To create accounts automatically for new employees
  2. To encrypt data stored in Azure Storage accounts
  3. To periodically confirm that users still need their access Correct answer.
  4. To require multi-factor authentication at every sign-in

Explanation

Access reviews let reviewers attest on a schedule that users or guests still require access, and the results can automatically remove access that is no longer needed. They are a governance control rather than an authentication or provisioning control.

Question 14Manage Azure identities and governance

You must be alerted when a subscription's monthly spend exceeds 80 percent of a planned amount. What should you create?

  1. A budget with an alert threshold at 80 percent Correct answer.
  2. A metric alert rule on the subscription
  3. A resource lock on the billing resource group
  4. A policy definition with the Audit effect

Explanation

Cost Management budgets track actual or forecast cost against a limit and raise alerts when configured thresholds are crossed. Azure Monitor metric alerts and Azure Policy do not evaluate cost data.

Question 15Manage Azure identities and governance

A move operation for a virtual machine fails because of a CanNotDelete lock. What should you do?

  1. Assign the Contributor role on the target resource group
  2. Delete the lock, move the resource, and then create the lock again Correct answer.
  3. Delete the virtual machine and redeploy it in the target group
  4. Convert the lock to a ReadOnly lock

Explanation

A lock on a resource or its dependencies blocks a move, so the lock must be removed before the move and can be recreated afterwards. Changing the lock type does not remove the restriction.

Question 16Manage Azure identities and governance

Users must be able to reset their on-premises Active Directory password from the Microsoft Entra self-service password reset portal. Which feature must you enable?

  1. Password writeback Correct answer.
  2. Group writeback
  3. Seamless single sign-on
  4. Password hash synchronization

Explanation

Password writeback sends password changes made in the cloud back to on-premises Active Directory, which is required for self-service reset of on-premises passwords. Password hash synchronization only flows hashes from on-premises to the cloud.

Question 17Manage Azure identities and governance

A user is assigned Reader at the subscription and Contributor on resource group RG1. RG2 is another resource group in the same subscription. What can the user do with the resources in RG2?

  1. Assign roles on the resources
  2. View the resources but not change them Correct answer.
  3. Nothing, because the conflicting assignments cancel each other
  4. Modify and delete the resources

Explanation

Role assignments are additive and inherited, so the user has Contributor in RG1 and Reader everywhere else in the subscription, including RG2. Reader permits viewing resources but not changing them.

Question 18Manage Azure identities and governance

You need to apply a set of 20 related policy definitions together and track their compliance as one assignment. What should you use?

  1. A policy initiative assigned to the scope Correct answer.
  2. A custom RBAC role containing 20 actions
  3. 20 individual resource locks
  4. A single policy definition with 20 parameters

Explanation

A policy initiative (policy set definition) groups multiple policy definitions so they can be assigned and reported as a single unit. Individual definitions would require separate assignments and separate compliance views.

Question 19Manage Azure identities and governance

A helpdesk team in the United Kingdom must be able to reset passwords only for UK users. What should you configure?

  1. An administrative unit containing the UK users Correct answer.
  2. A Conditional Access policy scoped to a group of UK users
  3. A dynamic device group filtered by operating system
  4. A custom RBAC role assigned at the subscription

Explanation

Administrative units restrict directory role permissions to a defined collection of users or groups, so a Helpdesk Administrator scoped to the unit can act only on its members. Conditional Access controls sign-in conditions rather than administrative scope.

Question 20Manage Azure identities and governance

You must require multi-factor authentication only for sign-ins that originate outside the corporate network. What should you configure?

  1. Security defaults in Microsoft Entra ID
  2. Self-service password reset with additional authentication methods
  3. A Conditional Access policy with a location condition Correct answer.
  4. Per-user multi-factor authentication

Explanation

A Conditional Access policy can combine a location condition with a grant control that requires multi-factor authentication, so only sign-ins from outside the trusted locations are challenged. Security defaults and per-user MFA apply to all sign-ins.

Question 21Manage Azure identities and governance

A deny assignment exists on a resource group because of a managed application. Which statement describes its effect?

  1. The deny assignment applies only to guest users
  2. Any subscription Owner can delete the deny assignment
  3. Users who hold the Owner role at the subscription bypass the deny assignment
  4. Users are blocked from the denied operations even when an RBAC role grants them Correct answer.

Explanation

Deny assignments are evaluated alongside role assignments and always win, so an operation is blocked even if an RBAC role allows it. They are created by services such as managed applications and are not editable by subscription Owners.

Question 22Manage Azure identities and governance

You create a custom role whose AssignableScopes contains only /subscriptions/Sub1. Where can this role be assigned?

  1. Only on Sub1 and the scopes beneath it Correct answer.
  2. On any subscription in the tenant
  3. Only on the tenant root management group
  4. On Sub1 and any management group above it

Explanation

AssignableScopes limits a custom role to the scopes listed, and those scopes include their children. A scope of Sub1 therefore permits assignment on Sub1, its resource groups, and its resources.

Question 23Manage Azure identities and governance

You need to allow a group to read blobs in a storage account only when each blob carries the tag Project=Contoso. What should you configure?

  1. A policy with the Append effect on the storage account
  2. A role assignment condition on a blob data role Correct answer.
  3. A ReadOnly resource lock on the storage account
  4. A deny assignment on the storage account

Explanation

Attribute-based access control conditions on a data-plane role assignment can require a blob index tag to match a value before access is granted. Resource locks and policy effects do not evaluate per-blob tags for authorization decisions.

Question 24Manage Azure identities and governance

You assign a policy with the modify effect to add a missing tag. After several hours, resources that existed before the assignment still lack the tag. What should you do?

  1. Create and run a remediation task for the policy assignment Correct answer.
  2. Change the policy effect to Audit
  3. Reassign the policy at a higher scope
  4. Restart the affected resources

Explanation

The modify effect applies automatically to new or updated resources, but existing resources must be corrected by a remediation task that uses the assignment's managed identity. Reassigning or restarting resources does not trigger the correction.

Question 25Manage Azure identities and governance

External partners must request access to a security group, have the request approved by their manager, and lose access automatically after 60 days. Which feature should you use?

  1. An access package in entitlement management Correct answer.
  2. A Privileged Identity Management role setting
  3. A dynamic group with a 60-day membership rule
  4. A Conditional Access policy with session controls

Explanation

Access packages in entitlement management provide request workflows with approval, defined assignment duration, and expiry, and they support external users through connected organizations. Dynamic groups cannot enforce approval or expiry workflows.

Question 26Manage Azure identities and governance

A user account was deleted 12 days ago. An administrator needs to restore the account. For how long after deletion does Microsoft Entra ID keep a deleted user account available for restoration?

  1. 90 days after deletion
  2. 7 days after deletion
  3. 30 days after deletion Correct answer.
  4. Deleted accounts can never be restored

Explanation

Deleted user objects are moved to a soft-deleted state and kept for 30 days, during which an administrator can restore the account with the same object ID and most of its properties. After the retention period expires, the object is permanently purged and cannot be recovered. Restores are performed from the Deleted users list in the portal.

Question 27Manage Azure identities and governance

What is the maximum number of tags that can be applied directly to a single Azure resource?

  1. 100 tags
  2. 15 tags
  3. 20 tags
  4. 50 tags Correct answer.

Explanation

Azure supports up to 50 tags per resource and per resource group. Attempting to apply more than that causes the deployment or update to fail. Tag names are limited to 512 characters and tag values to 256 characters.

Question 28Manage Azure identities and governance

How many levels of management groups can you create beneath the tenant root group?

  1. Ten levels
  2. Three levels
  3. Six levels Correct answer.
  4. Four levels

Explanation

A management group hierarchy supports up to six levels of management groups, not counting the root management group or the subscription level. Deeper nesting is rejected when the management group is created. Ten levels is a common distractor because it resembles other service quotas.

Question 29Manage Azure identities and governance

In an Azure Policy definition, which JSON element contains the conditions that are evaluated against a resource?

  1. then
  2. mode
  3. parameters
  4. if Correct answer.

Explanation

A policy definition is built from an if block that holds the condition being evaluated and a then block that holds the resulting effect. The mode element controls which resource types the policy evaluates, and parameters supply values at assignment time.

Question 30Manage Azure identities and governance

Licenses are assigned to a security group, but several group members never receive a license. What should you check first?

  1. That the group is a mail-enabled security group
  2. That the group has at least two owners assigned
  3. That each affected user has a usage location configured Correct answer.
  4. That each affected user holds the License Administrator role

Explanation

Group-based licensing requires every user to have a usage location, because license SKUs are restricted by country or region. Users without a usage location fail licensing and are reported as errors on the group. Membership type and group owners have no effect on license delivery.

Question 31Manage Azure identities and governance

A user is assigned the Global Administrator role in Microsoft Entra ID but reports that no resources are visible in the Azure subscription. What is the cause?

  1. The administrator must activate the role through PIM first
  2. Directory roles do not grant access to Azure resources by default Correct answer.
  3. The subscription belongs to a different Microsoft Entra tenant
  4. Azure role assignments can take up to 24 hours to propagate to the subscription

Explanation

Microsoft Entra directory roles and Azure RBAC are separate authorization systems. Global Administrator grants control over directory objects but no access to subscriptions or resource groups. The administrator must use the elevate access option in the tenant properties, which assigns User Access Administrator at the root scope.

Question 32Manage Azure identities and governance

You plan to move a virtual machine into a resource group in a different subscription. What is a requirement for the move?

  1. The target resource group must be in the same region as the source resource group
  2. The virtual machine must first be exported as an ARM template
  3. Both subscriptions must belong to the same Microsoft Entra tenant Correct answer.
  4. Both subscriptions must use the same billing account

Explanation

Moving resources between subscriptions requires both subscriptions to be associated with the same Microsoft Entra tenant, and the target resource provider must already be registered. The move is performed by the resource provider and typically preserves the resource ID of the resource group's new scope rather than redeploying from a template.

Question 33Manage Azure identities and governance

You need to identify resources that violate a naming convention without preventing their deployment. Which Azure Policy effect should you use?

  1. DeployIfNotExists
  2. Modify
  3. Deny
  4. Audit Correct answer.

Explanation

The Audit effect records a non-compliance entry for the resource without blocking or altering the request. Deny blocks the deployment, while Modify and DeployIfNotExists change or create resources during remediation. Audit is the standard choice for reporting-only governance.

Question 34Manage Azure identities and governance

A CanNotDelete lock is applied at the subscription scope. What is the effect on resources in that subscription?

  1. Only resources created after the lock is applied are affected
  2. Only resources in the subscription's first resource group are affected
  3. All resources in the subscription inherit the lock Correct answer.
  4. Only the subscription object itself is protected

Explanation

Management locks apply to the scope where they are created and are inherited by all child scopes, including resource groups and resources. A CanNotDelete lock at subscription scope therefore protects every resource in every resource group. Inherited locks cannot be removed at the child level; the lock must be removed at its own scope.

Question 35Manage Azure identities and governance

You have added a custom domain name to Microsoft Entra ID. Which DNS record is used to prove that you own the domain?

  1. A PTR record for the domain
  2. A CNAME record for the tenant name
  3. An SRV record named _sipfederationtls
  4. A TXT record containing the verification value Correct answer.

Explanation

Microsoft Entra ID verifies domain ownership by having you create a DNS record at the registrar that contains a unique verification value, typically a TXT record. Once the record is detected, the domain is marked as verified and can be used in user principal names.

Question 36Manage Azure identities and governance

A newly hired technician must register a FIDO2 security key before any password is issued to them. Which feature should you use?

  1. An access package
  2. A self-service password reset policy
  3. A Windows Hello for Business policy
  4. A Temporary Access Pass Correct answer.

Explanation

A Temporary Access Pass is a time-limited passcode that lets a user without a password or registered method sign in and register passwordless credentials. It can be issued as a one-time pass and limited to a specific lifetime. Self-service password reset and access packages do not address passwordless enrollment for a brand-new account.

Question 37Manage Azure identities and governance

You want to see what a new Conditional Access policy would block before you enforce it. Which policy state should you use?

  1. Report-only Correct answer.
  2. On
  3. Enabled for all users only
  4. Off

Explanation

Report-only mode evaluates the policy against sign-ins and records the results in the sign-in logs without enforcing the grant controls. This lets administrators measure impact before switching the policy to On. The Off state performs no evaluation at all.

Question 38Manage Azure identities and governance

A policy assignment that uses the DeployIfNotExists effect does not remediate non-compliant resources. What should you configure on the assignment?

  1. The Audit effect instead of DeployIfNotExists
  2. An exclusion for each non-compliant resource
  3. A CanNotDelete lock on the target resource group
  4. A managed identity with the roles required by the effect Correct answer.

Explanation

Remediation-capable effects such as DeployIfNotExists and Modify require the assignment to have a managed identity that holds the permissions needed to create or change resources. Without that identity, the assignment can evaluate compliance but cannot remediate. The identity is created on the assignment and granted a role at the assignment scope.

Question 39Manage Azure identities and governance

You must prevent guest users from enumerating the directory while still allowing them to sign in and use shared resources. Which setting should you change?

  1. Guest user access restrictions in external collaboration settings Correct answer.
  2. Conditional Access session controls
  3. The default user role permissions for member users
  4. The self-service sign-up setting for external users

Explanation

External collaboration settings include a guest user access restriction that controls whether guests can enumerate users, groups, and other directory objects. Setting it to the most restrictive option limits guests to their own profile object while leaving resource access intact. Conditional Access controls sign-in conditions, not directory read permissions.

Question 40Manage Azure identities and governance

An Azure Policy assignment is created at the scope of a management group. Which resources does the assignment evaluate?

  1. Only resources in the subscription where the assignment was created
  2. Only resources in the management group's parent subscription
  3. All resources in subscriptions under that management group, including nested management groups Correct answer.
  4. Only resources tagged with the management group name

Explanation

Policy assignments are inherited down the management group hierarchy, so an assignment at a management group applies to every child management group and every subscription within them. Individual child scopes can be excluded by using notScopes, but by default all resources beneath the scope are evaluated.

Question 41Manage Azure identities and governance

You delete a resource group that contains 12 virtual machines. What happens to the virtual machines?

  1. They are moved to the default resource group
  2. They are soft-deleted and can be restored for 30 days
  3. They are retained but become unmanaged
  4. They are deleted along with the resource group Correct answer.

Explanation

A resource group is a container, and deleting it deletes every resource it contains. The virtual machines, their disks, and network interfaces are removed with the group. Soft delete applies to some individual services and to directory objects, not to resource group deletion as a whole.

Question 42Manage Azure identities and governance

A resource group is tagged with CostCenter=1234, but a virtual machine created in that group has no tags. Why does the virtual machine lack the tag?

  1. Tag inheritance works only for resources in the same region
  2. The CostCenter tag name is reserved for billing and cannot be set
  3. Tags require the Owner role on each individual resource
  4. Tags are not inherited from a resource group to its resources Correct answer.

Explanation

Tags applied to a resource group or subscription are not automatically inherited by the resources inside them. To enforce inheritance you can assign a policy with the modify effect that appends or copies the parent tag onto child resources. Billing reports based on tags therefore depend on tags being present on the resources themselves.

Question 43Manage Azure identities and governance

An administrator must create 300 user accounts from a spreadsheet. What is the most efficient approach?

  1. Deploy an ARM template that defines each account
  2. Create a dynamic group that generates the accounts
  3. Synchronize the accounts with Microsoft Entra Connect
  4. Use bulk create users with the downloadable CSV template Correct answer.

Explanation

The bulk operations feature accepts a CSV file in the documented template format and creates many users in a single operation. It reports per-row results so errors can be corrected and retried. Microsoft Entra Connect is intended for ongoing synchronization from an on-premises directory, not a one-time import.

Question 44Manage Azure identities and governance

An employee will be away for six months. The account must not be able to sign in, but the mailbox and permissions must be preserved. What should you configure?

  1. Set the account's sign-in status to blocked Correct answer.
  2. Revoke the user's refresh tokens
  3. Delete the user account
  4. Remove all role assignments from the account

Explanation

Blocking sign-in prevents the account from authenticating while keeping the object, mailbox, group memberships, and permissions intact. Deleting the account would remove those relationships. Blocking is reversible by changing the sign-in status back to Allowed.

Question 45Manage Azure identities and governance

Self-service group management is enabled and a security group has designated owners. Who can approve requests to join the group?

  1. Only a User Administrator
  2. Only a Global Administrator
  3. Only the person who originally created the group
  4. The owners of the group Correct answer.

Explanation

When self-service group management is enabled, group owners can approve or reject join requests and manage membership without an administrator. Owner approval can also be delegated to members if the group is configured that way. Administrative directory roles are not required for routine membership changes.

Question 46Manage Azure identities and governance

Which sign-in method continues to authenticate users to cloud applications when the on-premises directory is unavailable?

  1. Federation with Active Directory Federation Services
  2. Certificate-based authentication
  3. Pass-through authentication
  4. Password hash synchronization Correct answer.

Explanation

Password hash synchronization stores a hash of the on-premises password hash in Microsoft Entra ID, so sign-in is validated entirely in the cloud. Pass-through authentication and federation both rely on on-premises components, so an outage in the datacenter interrupts sign-in.

Question 47Manage Azure identities and governance

You must block B2B collaboration with one specific partner tenant while continuing to allow all other external tenants. What should you configure?

  1. Guest user access restrictions
  2. Organization-specific cross-tenant access settings Correct answer.
  3. Conditional Access named locations
  4. An access review for guest users

Explanation

Cross-tenant access settings define default inbound and outbound collaboration rules and allow organization-specific overrides for individual tenants. Adding an organization-specific entry for the partner tenant lets you block B2B collaboration with that tenant only, leaving the defaults in place for everyone else.

Question 48Manage Azure identities and governance

Which statement about Azure resource groups is correct?

  1. Resource groups can be nested only inside a management group
  2. Resource groups cannot be nested inside one another Correct answer.
  3. Resource groups can be nested up to six levels deep
  4. Resource groups can be nested when they share the same region

Explanation

A resource group is a flat container and cannot contain another resource group. Organization above the resource level is provided by management groups and subscriptions, and within a resource group by tags. Six levels is the limit for management groups, not resource groups.

Question 49Manage Azure identities and governance

A company has no Microsoft Entra ID P1 licenses and must require multi-factor authentication for every user. What should the administrator enable?

  1. Self-service password reset
  2. A Conditional Access policy
  3. Security defaults Correct answer.
  4. Privileged Identity Management

Explanation

Security defaults are a preconfigured set of baseline protections available to every tenant at no extra cost, including requiring MFA registration and enforcement for all users. Conditional Access requires Microsoft Entra ID P1 or higher, and PIM requires P2. Security defaults are turned off automatically once Conditional Access policies are in use.

Question 50Implement and manage storage

Which redundancy option keeps three synchronous copies of a storage account's data within a single Azure region?

  1. Locally redundant storage (LRS) Correct answer.
  2. Read-access geo-redundant storage (RA-GRS)
  3. Geo-redundant storage (GRS)
  4. Zone-redundant storage (ZRS)

Explanation

LRS replicates each write three times within a single region, across separate fault and update domains. ZRS spreads copies across availability zones, and GRS/RA-GRS replicate to a second region.