EarnYourCert
Open the app
Exams › AZ-104 › Domain 1 of 5
AZ-104 · Domain 1 of 5 · 20-25% of the exam

Manage Azure identities and governance

Domain 1 of AZ-104 accounts for 20-25% of the exam, the heaviest part of the syllabus. EarnYourCert has 124 original questions for this domain, all with explanations: 83 multiple choice, 22 yes/no and 19 completion or ordering items, like the real exam.

Practice domain 1 for free →No sign-up. Choose how many questions you want.

What this domain covers

  • 1.1Manage Microsoft Entra users and groups40 questions
  • 1.2Manage access to Azure resources41 questions
  • 1.3Manage Azure subscriptions and governance43 questions

Domain 1 sample questions

8 questions from our 124-question bank for this domain. Try to answer before revealing the solution.

1. Which dynamic membership rule would automatically add a user to the 'Sales Team' group if their department attribute is 'Sales'?

  1. department CONTAINS "Sales"
  2. group.department == "Sales"
  3. user.department = Sales
  4. user.department -eq "Sales"
Show answer

Correct answer: D. Dynamic membership rules use an expression-style syntax referencing object properties, for example user.department -eq "Sales", to automatically include users that meet the condition.

2. In the Microsoft Entra ID portal, what information is needed at minimum in the CSV template for a 'bulk create' user operation?

  1. User principal name (UPN), display name, and initial password, among other fields required by the template
  2. Only the user's personal email address, since other fields such as UPN and department are generated automatically
  3. The Object ID and the Azure subscription access key where the user accounts will be created
  4. The Microsoft 365 E3 or E5 license number of each user, which must be specified manually in each row of the CSV file
Show answer

Correct answer: A. The Microsoft Entra ID bulk create CSV template includes required columns such as the user principal name (UPN), display name, and an initial password, plus other optional attributes.

3. In Azure AD Entitlement Management, what is a 'catalog'?

  1. A container of resources and access packages that can be managed by delegated owners
  2. A consolidated list of all active guest (B2B) users who have access to the Microsoft Entra ID directory
  3. An audit report collecting all access to Azure resources recorded in the subscription activity log
  4. A grouped collection of Conditional Access policies organized by functional area or department of the organization
Show answer

Correct answer: A. In Entitlement Management, a catalog is a container that groups resources (groups, applications, SharePoint sites) and the access packages built from them. Catalog owners can delegate management without needing to be global administrators.

4. What is the purpose of access reviews in Azure AD Entitlement Management?

  1. Periodically review whether users still need access to resources and revoke unnecessary access
  2. Audit all high or medium risk sign-ins detected by Microsoft Entra ID Identity Protection in the tenant
  3. Review and update the Conditional Access policies configured in the tenant to ensure compliance with the security baseline
  4. Generate detailed per-user cost reports of Azure resources consumed during the billing period
Show answer

Correct answer: A. Access reviews allow administrators or resource owners to periodically review who has access to which resources. Users whose access is not confirmed can be automatically removed, enforcing the principle of least privilege.

5. Azure AD Identity Protection detects that several users have a 'high' user risk level. Which policy should you configure to require these users to change their password?

  1. A user risk policy requiring password change when risk is high
  2. A sign-in risk policy with a full access block action for the tenant
  3. A Conditional Access policy blocking all sign-ins for all users regardless of risk level
  4. A monthly scheduled access review to audit the permissions of users with detected risk
Show answer

Correct answer: A. The Identity Protection user risk policy evaluates the probability that a user account is compromised. When risk is high, the policy can require the user to perform a secure password change (via SSPR with MFA) to remediate the risk.

6. Which Microsoft Entra ID (Azure AD) license tier is required to use Privileged Identity Management (PIM) and Identity Protection risk policies?

  1. Microsoft Entra ID P2 (formerly Azure AD Premium P2)
  2. Microsoft Entra ID P1 (formerly Azure AD Premium P1)
  3. Microsoft Entra ID Free (included with any Azure subscription)
  4. Microsoft 365 Business Basic
Show answer

Correct answer: A. Advanced security features like PIM, Identity Protection with user and sign-in risk policies, and access reviews require Microsoft Entra ID P2 licenses. More basic features like basic Conditional Access are available with P1.

7. What is the 'AssignableScopes' field used for in a custom RBAC role definition?

  1. Define which scopes (subscriptions, resource groups, etc.) the custom role can be assigned in
  2. List the Microsoft Entra ID users and security groups to which the custom role is assigned
  3. Define the Azure resource types on which the custom role grants data-plane read access
  4. Specify the Azure regions where the custom role takes effect and can be used for access assignments
Show answer

Correct answer: A. The 'AssignableScopes' field in a custom role determines the scopes (e.g., a specific subscription or resource group) where the role can be listed and assigned. It restricts the custom role's visibility to the desired scopes.

8. What happens to RBAC role assignments when an Azure subscription is transferred to a different Azure AD tenant?

  1. All RBAC role assignments are deleted; they must be manually recreated in the new tenant
  2. RBAC role assignments are automatically migrated to the new tenant
  3. Only guest (B2B) user role assignments are deleted; native user assignments are preserved
  4. Role assignments are temporarily converted to deny assignments during the transfer
Show answer

Correct answer: A. When a subscription is transferred to a different Azure AD tenant, all RBAC role assignments are permanently deleted, since the user and group objects from the previous tenant do not exist in the new one. System-assigned managed identities are also lost. All roles must be manually recreated.

Practice domain 1 for free →

Other AZ-104 domains

2Implement and manage storage15-20% 3Deploy and manage Azure compute resources20-25% 4Implement and manage virtual networking15-20% 5Monitor and maintain Azure resources10-15% AZ-104: full practice exam→