Skip to content

5 Free AZ-104 Identity and governance Practice Questions

Practise AZ-104 identity and governance with five original scenario questions from the Pass104 question bank, covering RBAC delegation, Azure Policy remediation, dynamic group licensing, management group scope and SSPR for administrators, with an explanation for every choice. Every answer includes a worked explanation and Microsoft Learn sources. No account required.

Start with question 1
Work through the set

Four choices per question. Think through your answer, then open the explanation to check it.

5 questions · identity and governance · no timer

What these questions cover

These samples cover selected identity and governance skills in the Microsoft AZ-104 study guide. They are not a complete domain assessment.

Read each scenario, choose an answer, then open the explanation. All questions and answers are free on this page. In the app, the free plan gives you one 6-question exam a day across all domains; domain-targeted practice is a Pro feature.

Question 1 of 5Delegating Azure RBAC

User1 has the Contributor role at the scope of subscription Sub1, which contains resource group RG1. User1 must be able to grant colleagues Azure role assignments for the resources in RG1, but must not be able to manage access anywhere else in Sub1 or change governance settings such as policy assignments or locks. You can create one additional role assignment for User1. Which assignment follows the principle of least privilege?

  1. Role Based Access Control Administrator at the RG1 scope
  2. User Access Administrator at the RG1 scope
  3. Owner at the RG1 scope
  4. Role Based Access Control Administrator at the Sub1 scope
Show answer and explanation

Correct answer: A · Role Based Access Control Administrator at the RG1 scope

Contributor excludes Microsoft.Authorization write and delete operations, so User1 is missing only the right to create and remove role assignments. Role Based Access Control Administrator adds exactly roleAssignments/write and roleAssignments/delete, and does not allow access to be managed in other ways, such as Azure Policy. Assigned at RG1, it applies only to that resource group, while the subscription-level Contributor role continues to cover resource management. For tighter delegation, you can add a condition that limits which roles User1 can assign.

Why the other choices do not fit

  • B. User Access Administrator grants Microsoft.Authorization/*. At RG1, that also includes policy assignments, locks, and custom role definitions, which is more than role assignment management requires.
  • C. Owner at RG1 allows role assignments, but it grants every other Microsoft.Authorization operation as well. User1 already manages resources through Contributor, so Owner adds far more than needed.
  • D. The role is appropriate, but the scope is not. At Sub1, User1 could assign roles on every resource group in the subscription, breaking the requirement to stay within RG1.
Microsoft LearnBuilt-in roles: Contributor, RBAC Administrator, User Access Administrator Delegate Azure role assignment management with conditions
Question 2 of 5Azure Policy remediation

Your subscription contains 40 existing virtual machines and a Log Analytics workspace named LAW1. Policy assignment PA1 uses a deployIfNotExists definition that deploys diagnostic settings sending VM logs to LAW1. PA1 has a managed identity with the roles the definition requires. While the rollout is validated, PA1’s enforcement mode is Disabled (DoNotEnforce). Compliance results show all 40 VMs as noncompliant. You must deploy the diagnostic settings to those 40 VMs while PA1’s enforcement mode stays Disabled. What should you do?

  1. Set PA1’s enforcement mode to Default and wait for the next compliance evaluation
  2. Create a remediation task for PA1
  3. Change the policy definition’s effect to modify
  4. Trigger an on-demand compliance evaluation scan for the subscription
Show answer and explanation

Correct answer: B · Create a remediation task for PA1

Remediation tasks can be started for deployIfNotExists policies even when enforcementMode is DoNotEnforce. A remediation task uses the assignment’s managed identity to deploy the template to resources already flagged as noncompliant. This satisfies the requirement without changing the enforcement mode.

Why the other choices do not fit

  • A. This violates the requirement to keep enforcement disabled. Also, deployIfNotExists enforcement applies when a resource is created or updated; existing noncompliant resources still need a remediation task.
  • C. The modify effect changes properties or tags on the evaluated resource. Diagnostic settings are a separate resource, which is why this scenario uses deployIfNotExists.
  • D. A compliance scan only re-evaluates and reports compliance state. It does not deploy anything, so the 40 VMs would remain noncompliant.
Microsoft LearnPolicy assignment enforcement mode Remediate non-compliant resources
Question 3 of 5Dynamic groups and licensing

Litware, a commercial (non-education) organization, has a Microsoft Entra ID Free tenant with 300 users, all licensed for Office 365 Enterprise E3. You plan to create a security group named Group1 with dynamic user membership based on the department attribute. You will then use group-based licensing to assign Dynamics 365 licenses to Group1. Group1 will contain 40 users, and the Dynamics 365 licenses are already purchased. Neither subscription includes Microsoft Entra ID P1. Which additional purchase meets the plan’s licensing requirements at the lowest cost?

  1. Nothing; Office 365 Enterprise E3 already covers group-based licensing and dynamic membership
  2. Microsoft Entra ID P1 for all 300 users
  3. Microsoft Entra ID P1 for the 40 users in Group1
  4. Microsoft Entra ID P2 for the 40 users in Group1
Show answer and explanation

Correct answer: C · Microsoft Entra ID P1 for the 40 users in Group1

Separate the two features. Group-based licensing is not the blocker: the Office 365 Enterprise E3 tenant can already assign licenses to a group, so it needs no extra Microsoft Entra license. Dynamic membership groups require a Microsoft Entra ID P1 license (or Intune for Education, which is not relevant here) for each unique user who is a member of one or more dynamic groups. Only the 40 users in Group1 need to be covered. The licenses do not need to be assigned to those users, but the tenant must own enough P1 licenses for them.

Why the other choices do not fit

  • A. This is only half-true. Group-based licensing works in this tenant, but Office 365 Enterprise E3 does not include Microsoft Entra ID P1. P1 is required for users in dynamic membership groups.
  • B. P1 is the correct product, but the requirement is counted per unique member of dynamic groups. Covering all 300 users buys 260 licenses that the plan does not need.
  • D. P2 includes P1 capabilities and would work, but it costs more than P1 and adds features, such as Privileged Identity Management, that this plan does not use.
Microsoft LearnDynamic membership groups: license requirements Assign licenses to a group
Question 4 of 5Management groups and policy scope

Management groups MG-Finance and MG-Security are both direct children of the Tenant Root Group. MG-Finance contains 10 subscriptions, including Sub1. A custom security-baseline initiative is defined in MG-Security (its definition location) and assigned there. Sub1 must receive the security baseline and continue to inherit every policy and role assignment from MG-Finance. The other nine MG-Finance subscriptions must not be affected. What should you do?

  1. Add MG-Security as a second parent of Sub1, alongside MG-Finance
  2. Move Sub1 from MG-Finance into MG-Security
  3. Assign the existing initiative from MG-Security directly at the Sub1 scope
  4. Save a copy of the initiative with MG-Finance as its definition location, then assign the copy at the Sub1 scope
Show answer and explanation

Correct answer: D · Save a copy of the initiative with MG-Finance as its definition location, then assign the copy at the Sub1 scope

A policy or initiative definition can only be assigned at its definition location or within the hierarchy below it. Sub1 sits under MG-Finance, not MG-Security, so the existing definition is out of reach. A copy defined at MG-Finance can be assigned at the Sub1 scope. Defining it at MG-Finance does not affect the other nine subscriptions because only an assignment applies it. Sub1 keeps its parent and all inherited assignments.

Why the other choices do not fit

  • A. Each subscription and management group can have only one parent, so the hierarchy remains a tree. A subscription cannot have two parent management groups.
  • B. Sub1 would receive the baseline, but it would stop inheriting MG-Finance policy and role assignments. That breaks the second requirement.
  • C. This is the tempting shortcut, but Sub1 is not in the hierarchy under the initiative’s definition location, MG-Security. The assignment is not possible until the definition is available at a scope above Sub1.
Microsoft LearnManagement groups: one parent per subscription Policy definition location
Question 5 of 5SSPR for administrators

Your paid Microsoft Entra ID P1 tenant uses the custom domain contoso.com. SSPR is enabled for all users, with one method required to reset. The methods available to users are security questions, email, and Microsoft Authenticator. User1 has the User Administrator role and has registered security questions and an alternate email address. User1 still cannot reset their password by using SSPR. User1 must keep the User Administrator role. What should you do?

  1. Change the number of methods required to reset to 2
  2. Have User1 also register Microsoft Authenticator or a mobile phone number for SSPR
  3. Have User1 register additional security questions
  4. Configure the administrator SSPR policy to accept security questions as one of its methods
Show answer and explanation

Correct answer: B · Have User1 also register Microsoft Authenticator or a mobile phone number for SSPR

Administrator roles such as User Administrator are subject to a built-in two-gate SSPR policy, regardless of the user policy. It requires two pieces of authentication data, such as email, an authenticator app, or a phone number, and prohibits security questions. The one-gate exception does not apply because the tenant has a custom domain and is not a trial. User1’s email is valid for only one gate, so they need a second allowed method.

Why the other choices do not fit

  • A. The number of methods required in the user SSPR policy does not govern administrators. User1 would still have only one method that counts.
  • C. Security questions are prohibited for administrator accounts. More questions do not add a valid second gate.
  • D. The administrator policy is enforced by Microsoft and cannot be changed. You can disable SSPR for administrators, but not reduce or reconfigure its methods.
Microsoft LearnSSPR administrator reset policy differences

Continue your AZ-104 preparation

Review the concepts

Choose your next practice set

Read AZ-104 passing score explained to understand what practice results can tell you and plan your next study session.

Browse all AZ-104 guides and study resources.

Want to focus on identity and governance? Pro lets you choose domains for targeted practice. The free daily exam includes questions across all domains.

These original practice questions are adapted from the Pass104 question bank. They are not actual Microsoft exam questions and do not reproduce or predict exam difficulty or results. The selected answers and explanations include linked Microsoft Learn documentation. The public samples were last reviewed on 26 September 2026. Azure services and exam objectives can change, so use the references for the latest details. Pass104 is independent of Microsoft.