AZ-104 · Domain 1 of 5

AZ-104 Domain 1: Manage Azure identities and governance

This domain covers the administrator's control plane: managing Microsoft Entra users and groups, assigning access with Azure role-based access control, and governing subscriptions with Azure Policy, resource locks, tags and cost controls.

Exam weight
20–25%
Official functional groups
3
Estimated questions estimate
9–14
Suggested study time estimate
20–25 hrs

About 10 min read Reviewed October 2026

Overview

Manage Azure identities and governance is the foundation of the administrator role. It has three objective groups. Managing Microsoft Entra users and groups covers creating and managing users and groups, group and user properties, licenses, external users and self-service password reset. Managing access covers built-in Azure roles, assigning roles at different scopes, and interpreting access assignments. Managing subscriptions and governance covers Azure Policy, resource locks, tags, resource groups, subscriptions, management groups, and cost control with budgets, alerts and Azure Advisor.

At 20–25%, this is a top-weighted group and the one that governs everything else an administrator does. Unlike the fundamentals exam, AZ-104 tests how to perform these tasks: assigning the right role at the right scope, writing and assigning a policy, setting a lock, and controlling cost. The exam rewards knowing which control does what and applying it correctly within the management hierarchy.

How it's tested

AZ-104 questions are task-oriented, asking how to perform an administration task or which control to apply. In this domain they describe an access, governance or cost need and ask which role, scope, policy or control achieves it, favoring least privilege and the correct scope. Read the exact requirement and scope before choosing.

  • Right role and scope

    An access need is described, and you choose the built-in role and the scope at which to assign it.

  • Right governance control

    A control need is described, and you choose Azure Policy, a resource lock or RBAC.

  • Control cost

    A cost need is described, and you choose budgets, alerts, tags or Advisor recommendations.

Reasoning it through

An administrator must let a team manage virtual machines in one resource group but not elsewhere. Assigning Owner at the subscription grants far too much, and Contributor at the subscription is also too broad. Assigning the Virtual Machine Contributor role scoped to that specific resource group grants exactly the needed permissions in the right place, following least privilege, which is the assignment the exam expects.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

1.1 Manage Microsoft Entra users and groupsUsers, groups, properties, licenses, external users and self-service password reset.
What it means
This covers creating and managing Microsoft Entra users and groups, managing user and group properties, assigning licenses in Entra ID, managing external (guest) users, and configuring self-service password reset.
What to understand
Microsoft Entra ID is Azure's identity service. Groups simplify access and license assignment, with security groups for access and dynamic groups populated by rules. External users are invited as guests. Self-service password reset lets users reset their own passwords, reducing helpdesk load. Licenses are often assigned via groups.
How it shows up
A user, group or identity task is described, and you must choose how to create or configure it.
Common confusion
Confusing security groups with Microsoft 365 groups, or assigned with dynamic group membership; dynamic groups are populated automatically by rules.
1.2 Manage access to Azure resourcesBuilt-in Azure roles, scopes, and interpreting access assignments.
What it means
This covers Azure role-based access control: managing built-in roles such as Owner, Contributor, Reader and resource-specific roles, assigning roles at different scopes (management group, subscription, resource group, resource), and interpreting effective access from assignments.
What to understand
Azure RBAC grants permissions through role assignments at a scope, and assignments inherit downward, so a role at the subscription applies to all its resource groups. Least privilege means choosing the narrowest role and scope that meets the need. Owner can also manage access, while Contributor cannot.
How it shows up
An access requirement is described, and you must choose the built-in role and the scope to assign it.
Common confusion
Confusing Contributor with Owner; Owner can manage access assignments while Contributor cannot, though both can manage resources.
1.3 Manage Azure subscriptions and governanceAzure Policy, resource locks, tags, resource groups, management groups and cost control.
What it means
This covers implementing and managing Azure Policy, configuring resource locks, applying and managing tags, managing resource groups and subscriptions, configuring management groups, and managing costs with budgets, alerts and Azure Advisor recommendations.
What to understand
Azure Policy enforces and audits configuration rules, flowing down the hierarchy. Resource locks prevent deletion or modification regardless of permissions. Tags organize resources and attribute cost. Budgets and alerts in Cost Management track spend, and Advisor recommends optimizations. These are distinct controls for distinct needs.
How it shows up
A governance or cost requirement is described, and you must choose Policy, a lock, tags, or a cost-control feature.
Common confusion
Confusing Azure Policy with RBAC and resource locks; Policy enforces configuration, RBAC grants permissions, and locks prevent deletion.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Azure RBAC role assignment

    Granting a role to a principal at a scope.

    Remember
    Assignments inherit downward through the hierarchy.
    Tested as
    Access questions.
    Trap
    Assigning at too broad a scope.

  • Built-in roles

    Owner, Contributor, Reader and resource-specific roles.

    Remember
    Owner manages access; Contributor does not.
    Tested as
    Access questions.
    Trap
    Confusing Owner with Contributor.

  • RBAC scopes

    Management group, subscription, resource group, resource.

    Remember
    Choose the narrowest scope that meets the need.
    Tested as
    Access questions.
    Trap
    Assigning at the subscription where a resource group fits.

  • Dynamic groups

    Groups populated automatically by membership rules.

    Remember
    Membership updates as attributes change.
    Tested as
    Group questions.
    Trap
    Confusing them with assigned groups.

  • Self-service password reset

    Lets users reset their own passwords.

    Remember
    It reduces helpdesk load and needs authentication methods.
    Tested as
    Identity questions.
    Trap
    Overlooking the authentication method requirement.

  • Azure Policy

    Enforces and audits configuration rules across resources.

    Remember
    It governs configuration, not permissions.
    Tested as
    Governance questions.
    Trap
    Confusing it with RBAC.

  • Resource locks

    Prevent deletion or modification of resources.

    Remember
    They block changes regardless of permissions.
    Tested as
    Governance questions.
    Trap
    Confusing them with Policy or RBAC.

  • Tags

    Labels for organizing and attributing cost.

    Remember
    They enable cost breakdowns by team or project.
    Tested as
    Governance and cost questions.
    Trap
    Expecting cost attribution without tags.

  • Management hierarchy

    Management groups, subscriptions, resource groups, resources.

    Remember
    Policy and RBAC assigned higher up flow down.
    Tested as
    Governance questions.
    Trap
    Misplacing a control in the hierarchy.

  • Budgets and cost alerts

    Track spend and alert when thresholds are approached.

    Remember
    They warn before costs exceed a limit.
    Tested as
    Cost questions.
    Trap
    Confusing them with the pricing calculator.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Azure RBAC vs. Azure Policy vs. resource locks

ConceptMeaningKey differenceCommon trap
Azure RBAC Grants permissions to principals Controls who can act Confusing it with Policy
Azure Policy Enforces configuration rules Controls what configuration is allowed Expecting it to grant access
Resource locks Prevent deletion or changes Block changes regardless of permissions Confusing with Policy

Owner vs. Contributor vs. Reader

ConceptMeaningKey differenceCommon trap
Owner Full access including managing access Can assign roles Giving it where Contributor suffices
Contributor Manage resources but not access Cannot assign roles Confusing it with Owner
Reader View only No changes Using it where management is needed

Assigned vs. dynamic group membership

ConceptMeaningKey differenceCommon trap
Assigned Members added manually Static membership Using it where membership should auto-update
Dynamic Members by rule on attributes Membership updates automatically Confusing it with assigned

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Owner for resource management

    What candidates pick
    Assign Owner to a team that only needs to manage resources.
    Why it looks right
    Owner has full access.
    Why it's wrong
    Contributor manages resources without the ability to assign access, which is least privilege for resource management.

    Clue to watch for The team manages resources but does not need to grant access.

  2. Subscription scope for one group

    What candidates pick
    Assign a role at the subscription to grant access to one resource group.
    Why it looks right
    It is simpler.
    Why it's wrong
    A subscription-scoped assignment grants access to all resource groups; scope it to the specific resource group.

    Clue to watch for Access should be limited to one resource group.

  3. Policy prevents deletion

    What candidates pick
    Use Azure Policy to stop a resource from being deleted.
    Why it looks right
    Policy governs resources.
    Why it's wrong
    Azure Policy enforces configuration; a resource lock prevents deletion.

    Clue to watch for The need is to block accidental deletion.

  4. Policy grants access

    What candidates pick
    Use Azure Policy to give a user permissions.
    Why it looks right
    Policy governs resources.
    Why it's wrong
    Azure Policy enforces configuration; RBAC grants permissions.

    Clue to watch for The need is to grant permissions.

  5. Assigned where dynamic fits

    What candidates pick
    Manually maintain a group whose membership should follow an attribute.
    Why it looks right
    Manual membership is familiar.
    Why it's wrong
    A dynamic group updates membership automatically from a rule, reducing manual effort.

    Clue to watch for Membership should change automatically as user attributes change.

  6. No tags, cost breakdown

    What candidates pick
    Expect per-team cost reports without tagging resources.
    Why it looks right
    Cost Management shows spend.
    Why it's wrong
    Tags attribute costs to teams or projects; without them, team breakdowns are not possible.

    Clue to watch for The need is to attribute cost by team or project.

Answer framework

For any Domain 1 identity or governance scenario, use these steps to find the answer AZ-104 expects.

  1. Identify whether the need is identity, access, or governance and cost, since each uses different tools.
  2. For access, choose the narrowest built-in role and the narrowest scope that meets the need, remembering assignments inherit downward.
  3. Distinguish Owner (manages access) from Contributor (manages resources only) and apply least privilege.
  4. For governance, use Azure Policy for configuration rules, resource locks to prevent deletion, and tags for organization and cost, keeping these distinct from RBAC.
  5. For cost, use budgets and alerts to track spend, tags to attribute it, and Advisor recommendations to optimize. Record the change so the administrative action is auditable and repeatable.

Practice question

A team needs to create and manage virtual machines within a single resource group named RG-Prod, but must not be able to grant access to others or affect resources outside that resource group. Which role assignment follows least privilege?

Want more like this? The AZ-104 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Treat this as a hands-on governance domain, so practice the tasks in a free Azure subscription rather than just reading. Start with Azure RBAC, the heart of access administration: assign built-in roles at different scopes and watch how they inherit downward, and drill the Owner-versus-Contributor distinction and least privilege.

Next, learn the governance controls and keep them firmly separate: Azure Policy enforces configuration, resource locks prevent deletion, and tags organize and attribute cost. Practice writing and assigning a policy and setting a lock. Then learn cost control with budgets, alerts and Advisor.

Finally, cover Entra identity tasks: users, assigned versus dynamic groups, external users and self-service password reset. Because the exam tests doing, not defining, lab every task once in the portal and once with PowerShell or the CLI. Afterwards, move to Domain 2, implementing and managing storage. Lab every task once in the portal and once with PowerShell or the Azure CLI, and review missed practice questions by group to find weak spots.

FAQ

How much of AZ-104 is Domain 1?

Manage Azure identities and governance is 20–25% of the exam, a top-weighted group that governs access and configuration across the estate.

What is the difference between Owner and Contributor?

Both can manage resources, but Owner can also assign roles and manage access, while Contributor cannot. Contributor is the least-privilege choice for managing resources without granting access.

How do RBAC role assignments inherit?

A role assigned at a scope applies to that scope and everything below it. A role at the subscription applies to all its resource groups and resources, so scope to the narrowest level needed.

What is the difference between Azure Policy and a resource lock?

Azure Policy enforces and audits configuration rules, such as allowed regions. A resource lock prevents a resource from being deleted or modified regardless of permissions.

What is a dynamic group?

A Microsoft Entra group whose membership is set automatically by a rule based on user or device attributes, so membership updates as attributes change.

How do I attribute Azure costs to teams?

Apply tags to resources, then use Cost Management to break down spend by tag. Without tags, per-team cost attribution is not possible.

How does Domain 1 connect to the rest of the exam?

Identity, access and governance control every other administration task, so the roles, policies and scopes here apply across the storage, compute, networking and monitoring domains.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered Entra identity, Azure RBAC, Policy, locks, tags and cost control. Test whether you can choose the right role, scope and governance control under exam conditions.

Take the AZ-104 practice test Check your AZ-104 readiness

Keep going