Microsoft Azure Administrator - AZ-104 Practice Exam

About the AZ-104 certification

Exam code

AZ-104

Official exam guideDomain weightings come from the vendor and change over time. Check the official guide before you book.

1. 1.An administrator must delegate user management for one department without granting rights over the rest of the directory. Which Microsoft Entra ID feature scopes an administrative role to that subset of users?

   • AAn application security group
   • BA resource group
   • CA management group
   • DAn administrative unitCorrect answer

   Why

   An administrative unit is a container of users, groups, or devices that a directory role can be scoped to. Assigning the User Administrator role over the unit limits the delegate to the members of that unit.

2. 2.A group's membership must update automatically whenever a user's department attribute is set to Finance. Which group configuration achieves this?

   • AAn administrative unit containing the Finance users
   • BA Microsoft 365 group with assigned membership
   • CA security group with dynamic user membership and a membership ruleCorrect answer
   • DA security group with assigned membership

   Why

   A dynamic membership group evaluates a membership rule against user attributes and adds or removes members automatically. Assigned groups require an administrator to change the membership manually.

3. 3.Which method should an administrator use to create 500 new user accounts in Microsoft Entra ID in a single operation from the portal?

   • AA bulk create operation using the CSV templateCorrect answer
   • BAn ARM template deployment at subscription scope
   • CAn Azure Policy assignment with a deployIfNotExists effect
   • DA dynamic membership rule on a security group

   Why

   The portal supports bulk operations driven by a CSV template, including bulk create, bulk invite, and bulk delete. Uploading the completed template creates all the accounts in one job.

4. 4.An external partner must be given access to a single Azure resource without receiving a mailbox or a licensed account in the tenant. What should the administrator create?

   • AA user-assigned managed identity
   • BA service principal with a client secret
   • CA guest user invitationCorrect answer
   • DA new member user with a Microsoft 365 license

   Why

   A guest user invitation adds the partner as a B2B guest identity in the directory, which can then be given an RBAC role on the specific resource. No license or mailbox is provisioned by the invitation.

5. 5.Which two conditions must be satisfied before a user can reset their own password with self-service password reset? (Select TWO.)

   • AThe user is a member of an administrative unit
   • BThe user holds a directory role such as User Administrator
   • CThe user has registered the required number of authentication methodsCorrect answer
   • DSSPR is enabled for all users or for a group the user belongs toCorrect answer
   • EThe user's device is joined to the tenant

   Why

   SSPR must be enabled for a group the user belongs to or for all users, and the user must have registered the required number of authentication methods. A directory role assignment and a device join state are not prerequisites.

Practice all 65 questions

Frequently asked questions