Microsoft Azure Administrator - AZ-104

About the AZ-104 certification

Exam code

AZ-104

Official exam guideDomain weightings come from the vendor and change over time. Check the official guide before you book.

1. 1.An administrator must delegate user management for one department without granting rights over the rest of the directory. Which Microsoft Entra ID feature scopes an administrative role to that subset of users?

   • AAn administrative unitCorrect answer
   • BA management group
   • CA resource group
   • DAn application security group

   Why

   An administrative unit is a container of users, groups, or devices that a directory role can be scoped to. Assigning the User Administrator role over the unit limits the delegate to the members of that unit.

2. 2.A group's membership must update automatically whenever a user's department attribute is set to Finance. Which group configuration achieves this?

   • AA security group with dynamic user membership and a membership ruleCorrect answer
   • BA security group with assigned membership
   • CA Microsoft 365 group with assigned membership
   • DAn administrative unit containing the Finance users

   Why

   A dynamic membership group evaluates a membership rule against user attributes and adds or removes members automatically. Assigned groups require an administrator to change the membership manually.

3. 3.Which method should an administrator use to create 500 new user accounts in Microsoft Entra ID in a single operation from the portal?

   • AA bulk create operation using the CSV templateCorrect answer
   • BA dynamic membership rule on a security group
   • CAn Azure Policy assignment with a deployIfNotExists effect
   • DAn ARM template deployment at subscription scope

   Why

   The portal supports bulk operations driven by a CSV template, including bulk create, bulk invite, and bulk delete. Uploading the completed template creates all the accounts in one job.

4. 4.An external partner must be given access to a single Azure resource without receiving a mailbox or a licensed account in the tenant. What should the administrator create?

   • AA guest user invitationCorrect answer
   • BA new member user with a Microsoft 365 license
   • CA service principal with a client secret
   • DA user-assigned managed identity

   Why

   A guest user invitation adds the partner as a B2B guest identity in the directory, which can then be given an RBAC role on the specific resource. No license or mailbox is provisioned by the invitation.

5. 5.Which two conditions must be satisfied before a user can reset their own password with self-service password reset? (Select TWO.)

   • ASSPR is enabled for all users or for a group the user belongs toCorrect answer
   • BThe user has registered the required number of authentication methodsCorrect answer
   • CThe user holds a directory role such as User Administrator
   • DThe user's device is joined to the tenant
   • EThe user is a member of an administrative unit

   Why

   SSPR must be enabled for a group the user belongs to or for all users, and the user must have registered the required number of authentication methods. A directory role assignment and a device join state are not prerequisites.

Practice all 65 questions

Frequently asked questions