Microsoft’s July 2026 Entra ID wave shipped a production-ready directory Backup & Restore, moved External Multifactor Authentication to general availability, and pushed passkeys into standard registration campaigns. For the AZ-104 exam, that means the questions on Azure identities and governance now sit right on top of features you may have to configure in production this week. This ten-question set walks through the design tradeoffs behind those services so the exam scenarios feel like Monday morning at the office.
These are the first ten in our AZ-104 series (Questions 1-10). We are focusing this batch on Domain 1: managing Azure identities and governance. Expect scenarios that cover user and group lifecycle, administrative units, role-based access control (RBAC), subscription and management group scoping, and Azure Policy. However, we lean into where the exam actually hurts: choosing the right service given one hard constraint, not memorizing feature lists.
The difficulty mix is two easy warm-ups, five medium design-choice items, and three harder scenarios that test tradeoffs. Take your time on each scenario. Furthermore, try to identify the constraint that eliminates two of the four options before you reveal the answer.
Every real AZ-104 identity question hinges on one hard requirement — a scope, a compliance rule, a lifecycle constraint, or a cost ceiling. Once you spot that requirement, two of the four options usually collapse quickly. Consequently, the answer feels less like memorization and more like a small design decision. That mindset is what we practice below.
Question 1: Bulk User Onboarding
Contoso is onboarding 250 seasonal contractors next Monday. The HR system exports a spreadsheet with the required attributes. Your administrator wants the fastest supported path that does not require writing code. Which option should you choose?
A) Create each user manually in the Microsoft Entra admin center.
B) Use the Bulk create action in the Microsoft Entra admin center and upload the provided CSV template.
C) Deploy an Azure Function that calls Microsoft Graph POST /users.
D) Configure Entra Connect Sync to import the spreadsheet.
👁 Reveal Answer
Correct Answer: B
Explanation: The Microsoft Entra admin center exposes a built-in Bulk create operation that accepts a specific CSV template — this is the fastest no-code path for one-shot onboarding. Manual creation (A) fails the “fastest” test at 250 users. An Azure Function (C) works but requires writing code, which the scenario forbids. Entra Connect Sync (D) synchronizes an on-premises Active Directory; it does not ingest a spreadsheet. For example, the same CSV pattern also drives bulk invite and bulk delete.
Question 2: Inviting an External Auditor
Fabrikam needs to grant a third-party auditor read access to a specific resource group for two weeks. The auditor has a work email at a different tenant. Which approach requires the least effort while keeping the auditor’s identity in their home tenant?
A) Create a member account for the auditor in Fabrikam’s tenant.
B) Send a B2B guest invitation from Microsoft Entra External Identities and assign the Reader role at the resource group scope.
C) Provision a service principal for the auditor.
D) Create a shared mailbox and forward Azure alerts.
👁 Reveal Answer
Correct Answer: B
Explanation: B2B collaboration invites an external identity as a guest without creating a duplicate identity — the auditor keeps their home-tenant credentials, and access can be scoped to the exact resource group. Option A duplicates identity and creates a lifecycle problem. Option C is designed for applications, not humans. Option D does not grant Azure resource access at all. Therefore, B is the least-effort, correct-scope answer.
Question 3: Delegating Identity Governance with Administrative Units
Woodgrove Bank operates in five regions, and each regional IT lead should be able to reset passwords only for users in their region. However, no regional lead should see users in other regions. Which Microsoft Entra feature meets this requirement?
A) Assign the Global Administrator role scoped to a security group.
B) Create dynamic security groups per region and grant the User Administrator role tenant-wide.
C) Create administrative units (AUs) per region and assign the Password Administrator role scoped to each AU.
D) Use Conditional Access policies to filter which users each admin can view.
👁 Reveal Answer
Correct Answer: C
Explanation: Administrative units are the purpose-built Entra ID container for scoping a directory role — such as Password Administrator — to a subset of users. Option A grants tenant-wide power, violating least privilege. Option B still grants User Administrator across the whole tenant, so a regional lead could see everyone. Option D controls sign-in access, not admin scope. Consequently, only AUs deliver the scoped delegation Woodgrove needs for Azure identities and governance.
Question 4: Dynamic Group Membership
Your team at Northwind Traders wants a security group whose members are automatically all users in the Sales department, without manual maintenance. Which membership rule syntax is correct?
A) user.department -eq "Sales"
B) user.department == "Sales"
C) department = Sales
D) WHERE department = 'Sales'
👁 Reveal Answer
Correct Answer: A
Explanation: Entra dynamic membership rules use the syntax user.<property> -eq "<value>". Option B uses double-equals from C-family languages. Option C omits the required user. prefix and the correct operator. Option D borrows SQL syntax, which is not accepted. As a result, only A parses successfully in the dynamic group rule builder.
Question 5: Risk-Based Conditional Access
Litware detected unusual sign-in behavior for three finance accounts. The security team wants to require multifactor authentication only when Entra ID Protection reports a medium or high sign-in risk. Which building block should you configure?
A) A named-location Conditional Access policy that blocks anonymous IPs.
B) A Conditional Access policy with Sign-in risk set to Medium and High, granting access with MFA required.
C) A user risk policy set to Low.
D) A Continuous Access Evaluation revocation event.
👁 Reveal Answer
Correct Answer: B
Explanation: Sign-in risk is evaluated per authentication and is the correct signal for “unusual sign-in behavior.” A Conditional Access policy conditioned on Medium and High sign-in risk, with a grant control that requires MFA, meets the requirement exactly. Option A does not address the risk signal. Option C targets user risk (compromised account), which is a different signal and covers all sign-ins. Option D is a token-revocation mechanism, not an MFA enforcement policy. In addition, sign-in risk is the preferred trigger for step-up MFA scenarios.
Question 6: Least-Privilege RBAC for VM Restarts
Tailwind Traders wants an on-call operator who can only restart virtual machines in one resource group. However, the operator must not be able to change VM sizes, delete VMs, or read diagnostic secrets. Which approach best follows least privilege?
A) Assign the Owner role at the resource group scope.
B) Assign the built-in Virtual Machine Contributor role at the resource group scope.
C) Create a custom role that includes only Microsoft.Compute/virtualMachines/restart/action and Microsoft.Compute/virtualMachines/read, and assign it at the resource group scope.
D) Assign the Reader role at the subscription scope.
👁 Reveal Answer
Correct Answer: C
Explanation: None of the built-in roles limit the operator strictly to a restart, so a custom role is the least-privilege solution. Options A and B both grant destructive permissions such as delete and resize. Option D allows the operator to see resources but not restart them — the operation would fail. Specifically, the two required data plane actions are read to list VMs and restart/action to trigger the reboot.
Question 7: Enforcing Allowed Regions with Azure Policy
Adventure Works must ensure that new resources are created only in the East US and West Europe regions across all subscriptions. Which built-in Azure Policy accomplishes this?
A) “Allowed resource types.”
B) “Allowed locations.”
C) “Audit resource location.”
D) “Not allowed resource types.”
👁 Reveal Answer
Correct Answer: B
Explanation: The built-in “Allowed locations” policy has a Deny effect and restricts the regions where resources can be deployed — this is exactly the enforcement Adventure Works requires. Option A restricts resource types, not locations. Option C only logs violations without preventing them. Option D again targets types. Therefore, assigning “Allowed locations” at the management group scope covers the entire subscription hierarchy.
Question 8: Governing Policy Inheritance with Management Groups
The finance division at Contoso Ltd. has three subscriptions that all require a tag policy enforcing a CostCenter tag. However, the marketing division’s subscriptions should not receive the policy. Which design applies the policy with the least administrative overhead and correct scope for Azure identities and governance?
A) Assign the policy at the tenant root management group.
B) Create a Finance management group, move the three subscriptions into it, and assign the policy at that management group.
C) Assign the policy separately at each Finance subscription.
D) Assign the policy at each individual resource group inside the Finance subscriptions.
👁 Reveal Answer
Correct Answer: B
Explanation: Management groups are the mechanism for applying governance policies to a specific set of subscriptions and letting the assignment inherit downward. Option A would incorrectly apply the tag policy to marketing subscriptions too. Options C and D work but require repeated manual assignments — higher ongoing overhead and higher drift risk. As a result, a Finance management group scope is the cleanest inheritance boundary.
Question 9: External Multifactor Authentication with a Third-Party Provider
Fabrikam already runs Duo Security as its enterprise MFA provider. In July 2026, Microsoft moved External Multifactor Authentication in Entra ID to general availability. Fabrikam wants Conditional Access to enforce MFA using Duo rather than the native Microsoft Authenticator. What must you configure?
A) Federate the tenant to Duo using AD FS.
B) Register Duo as an External Multifactor Authentication method under Entra ID authentication methods, then reference it as the MFA control in Conditional Access.
C) Disable Security Defaults and rely on Duo’s radius proxy.
D) Import Duo tokens into the Microsoft Authenticator app.
👁 Reveal Answer
Correct Answer: B
Explanation: External Multifactor Authentication (renamed from “external authentication methods” at GA) lets an organization register a supported third-party provider such as Duo, and then Conditional Access grant controls can require MFA and route the challenge to that provider. Option A would federate authentication, which is a different pattern and does not scope MFA per policy. Option C bypasses Conditional Access. Option D is not a supported flow. Specifically, this is the July 2026 GA path Microsoft now recommends for organizations retaining an existing MFA vendor.
Question 10: Recovering Deleted Conditional Access Policies
Midway through a change window, Woodgrove Bank’s junior admin accidentally deleted several Conditional Access policies. Entra ID Backup went generally available in July 2026. What is the fastest supported recovery path?
A) Restore the policies from the most recent Entra ID directory backup using Backup & Restore in Entra ID.
B) Open a Microsoft support ticket and wait for tenant rollback.
C) Recreate every policy by hand from documentation.
D) Restore an Azure Resource Manager template of the subscription.
👁 Reveal Answer
Correct Answer: A
Explanation: The Entra ID Backup & Restore capability, generally available as of July 2026, is the Microsoft-supported path to restore directory configurations such as Conditional Access policies. Option B produces slow, best-effort recovery and is no longer the recommended path once Backup is enabled. Option C is high effort and prone to drift. Option D targets Azure resources, not Entra directory objects. Therefore, native Backup & Restore is the fastest, supported answer — and a strong argument for enabling it proactively.
Study Tips for Azure Identities and Governance
These focus areas consistently appear on the AZ-104 exam and reward hands-on practice with Azure identities and governance:
- Know your scopes. Every RBAC and Policy question hinges on scope: management group, subscription, resource group, or resource. Draw the hierarchy before you answer.
- Prefer least privilege. When two roles could work, choose the one with fewer permissions. Custom roles are correct more often than most learners expect.
- Distinguish sign-in risk from user risk. Sign-in risk is per authentication; user risk is per account. Conditional Access uses them differently.
- Watch the July 2026 GA features. External MFA, Entra ID Backup & Restore, and passkeys in registration campaigns are all fair game for scenario-based questions.
- Practice with the portal. Terminology changes; specifically, the “Microsoft Entra admin center” is the current name. Answers referencing “Azure AD portal” are usually distractor phrasing.
Keep Practicing Azure Identities and Governance
Great work getting through the first ten. Continued practice with Azure identities and governance scenarios is the single fastest way to move your AZ-104 score from “passing” to “confident.” For the authoritative source on Entra ID capabilities and current terminology, review the Microsoft Entra releases and announcements page — it is updated monthly and reflects the July 2026 wave referenced in Questions 9 and 10.
Ready for more practice? Continue with our other Microsoft series: AZ-305 Questions 1-10: Cost Optimization for architecture-level design thinking, AZ-900 Questions 91-100: Final Mixed Practice Test for a fundamentals refresher, and AI-102 Questions 11-20: Computer Vision Solutions if AI workloads are on your roadmap. Questions 11-20 in this AZ-104 series drop next — we will cover storage and networking. In the meantime, keep drilling and good luck on the exam.
