Manage Azure Identities and Governance
Targeted AZ-104 practice for this exam objective, with an explanation for every answer option.
- Certification
- AZ-104
- Domain
- Manage Azure Identities and Governance
- Questions
- 10
Practice AZ-104 Manage Azure Identities and Governance questions with exam-style scenarios, detailed explanations, and option-by-option rationale for this domain.
Example question from this objective
Each option is explained, so the reasoning behind the distractors is part of the answer.
How can department managers manage their teams' group memberships without tenant-wide administrator roles?
- Assign the manager as the group owner — group owners can add/remove members of THEIR group only.
- Make the manager an Application Administrator.
- Add the manager to the Domain Admins group in Entra ID.
- Give the manager Global Administrator role.
Assign the manager as the group owner — group owners can add/remove members of THEIR group only. — Correct. Group ownership is the least-privilege way to delegate group membership management.
Make the manager an Application Administrator. — Application Administrator is for app registrations, not groups.
Add the manager to the Domain Admins group in Entra ID. — Domain Admins is an on-prem AD concept; no equivalent in cloud-only Entra.
Give the manager Global Administrator role. — Global Admin is far too broad — full tenant control for one group's needs.