Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Manage Azure Identities and Governance (AZ-104) Syllabus

Manage Azure Identities and Governance (AZ-104) syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Manage Azure Identities and Governance (AZ-104) in Microsoft Azure Certifications (e.g. AZ-104, AZ-900), not a summary of it.

1. 1

   Microsoft Entra ID Management

   3 topics

   • Users and groups
     • Creating and managing user accounts
     • Bulk user operations
     • Security groups and Microsoft 365 groups
     • Dynamic group membership rules
   • Devices and self-service
     • Device registration and join types
     • Self-service password reset (SSPR)
   • External identities
     • Guest user (B2B) collaboration
     • Tenant configuration
2. 2

   Role-Based Access Control (RBAC)

   3 topics

   • Built-in and custom roles
     • Owner, Contributor, Reader and specialised roles
     • Creating custom role definitions
   • Role assignments and scope
     • Assigning roles at management group, subscription, resource group and resource scope
     • Inheritance and effective permissions
   • Distinguishing RBAC from Entra roles
     • Control-plane versus directory roles
3. 3

   Subscriptions and Governance

   3 topics

   • Managing subscriptions
     • Subscription management with management groups
     • Configuring cost management, budgets and alerts
   • Applying governance controls
     • Azure Policy assignment and remediation
     • Resource locks and tagging strategy
   • Diagnostic and access tooling
     • Reviewing access with the Activity log
     • Troubleshooting RBAC and policy effects

Manage Azure Identities and Governance (AZ-104) flashcards for Microsoft Azure Certifications (e.g. AZ-104, AZ-900)

24 of 51 cards from the Manage Azure Identities and Governance (AZ-104) deck — real questions with worked answers.

1. What is Microsoft Entra ID (formerly Azure Active Directory)?

   Microsoft's cloud-based identity and access management (IAM) service that provides authentication and authorization for users, groups, devices, and applications. It is the identity backbone for Azure, Microsoft 365, and SaaS apps.

2. What are the two main types of groups in Microsoft Entra ID, and how do they differ?

   Security groups (used to manage access to resources via role/permission assignment) and Microsoft 365 groups (provide collaboration features like a shared mailbox, calendar, and SharePoint site, and can include external users).

3. What is the difference between an 'Assigned' and a 'Dynamic' group membership type in Entra ID?

   Assigned: members are added/removed manually. Dynamic: membership is determined automatically by rules evaluating user or device attributes (e.g., department, country). Dynamic membership requires Entra ID P1 licensing.

4. What types of users can exist in Microsoft Entra ID based on their source?

   Cloud (member) identities created directly in Entra ID, synchronized identities from on-premises AD (via Entra Connect), and guest (external/B2B) users invited from another directory or via email.

5. What is a dynamic group membership rule, and give an example expression?

   A rule that automatically adds users/devices to a group based on attributes. Example: a rule like (user.department -eq "Sales") -and (user.country -eq "UK") includes all UK Sales users automatically.

6. What is the difference between deleting and permanently deleting a user in Entra ID, and what is the soft-delete retention period?

   A deleted user is soft-deleted and moved to the Deleted users area where it can be restored for 30 days. After 30 days it is permanently (hard) deleted automatically, or an admin can permanently delete it sooner.

7. What is Self-Service Password Reset (SSPR) in Microsoft Entra ID?

   A feature that lets users reset or change their own passwords without administrator help, using pre-registered authentication methods (e.g., mobile phone, email, security questions, Authenticator app), reducing helpdesk load.

8. How many authentication methods must a user register/verify against for SSPR, and how is this configured?

   Administrators define how many methods are required to reset a password (one or two) and which methods are available. Best practice requires two methods to verify identity before reset.

9. What are the three ways to register a device with Microsoft Entra ID, and how do they differ?

   Entra registered (BYOD/personal devices, user adds work account), Entra joined (corporate cloud-only devices joined directly to Entra ID), and Entra hybrid joined (devices joined to both on-premises AD and Entra ID).

10. What is the difference between Entra ID join and Entra hybrid join for devices?

    Entra ID join connects a device only to Entra ID (cloud-only, good for cloud-first orgs). Hybrid join connects a device to both on-premises Active Directory and Entra ID, used when on-premises AD authentication and group policy are still needed.

11. What licensing is required to enable Self-Service Password Reset for cloud users, and for write-back to on-premises AD?

    SSPR for cloud users requires Entra ID P1 (P2 also includes it; some basic reset is in free for admins). Password write-back to on-premises AD requires Entra ID P1 and Entra Connect with write-back enabled.

12. What is Microsoft Entra External ID (B2B collaboration)?

    A capability that lets you invite external users (partners, vendors) as guest accounts so they can access your apps and resources using their own existing credentials, without you managing their passwords.

13. What is the difference between Entra B2B and Entra B2C?

    B2B (business-to-business) invites external partners as guests into your corporate directory for collaboration. B2C (business-to-consumer / External ID for customers) is a separate identity solution for customer-facing apps, supporting social and local account sign-ups at large scale.

14. In Entra B2B collaboration, where is a guest user's credential validated?

    In the guest's home (resource) directory or identity provider. The host tenant never stores the guest's password; authentication is delegated to the guest's own identity provider, and only a guest object (reference) is created in the host tenant.

15. What is a cross-tenant access setting in Microsoft Entra External ID?

    A configuration that controls inbound and outbound B2B collaboration and B2B direct connect between your tenant and specific external Entra tenants, letting you trust MFA/device claims and allow or block particular organizations and users.

16. What is Azure Role-Based Access Control (RBAC)?

    An authorization system built on Azure Resource Manager that provides fine-grained access management to Azure resources by assigning roles (sets of permissions) to security principals at a specific scope.

17. What are the three elements that make up an Azure RBAC role assignment?

    Security principal (who: user, group, service principal, or managed identity), role definition (what permissions: a collection of actions/notActions), and scope (where: management group, subscription, resource group, or resource).

18. What are the four levels of scope in Azure RBAC, from broadest to narrowest?

    Management group, subscription, resource group, and resource. Access granted at a parent scope is inherited by all child scopes.

19. Name the three fundamental built-in Azure roles and what each allows.

    Owner (full access including managing access/assigning roles), Contributor (full access to manage resources but cannot grant access to others), and Reader (view-only access to resources).

20. What is the difference between the Contributor and Owner built-in roles?

    Both can create and manage all resource types. The difference is that Owner can also assign roles (manage access for others via Microsoft.Authorization/*), while Contributor cannot manage access permissions.

21. What does the 'User Access Administrator' built-in role allow?

    It lets a principal manage user access to Azure resources (i.e., create and remove role assignments) but does not grant the ability to manage the resources themselves.

22. What is the structure of an Azure RBAC role definition's permission set?

    A role definition contains Actions (allowed control-plane operations), NotActions (subtracted from Actions), DataActions (allowed data-plane operations), and NotDataActions (subtracted from DataActions). Effective permissions = (Actions − NotActions) plus (DataActions − NotDataActions).

23. In an Azure custom role, how are effective permissions calculated from Actions and NotActions?

    Effective control-plane permissions equal the Actions minus the NotActions: $\text{Permissions} = \text{Actions} - \text{NotActions}$. NotActions are not deny rules; they simply exclude operations from the granted Actions.

24. How does Azure RBAC evaluate access when a principal has multiple role assignments?

    Azure RBAC is additive: the principal's effective permissions are the union of all their role assignments at the relevant scope. There is no deny by default from RBAC roles unless an explicit Azure deny assignment applies.

See more Manage Azure Identities and Governance (AZ-104) flashcards →

Planning Manage Azure Identities and Governance (AZ-104) for Microsoft Azure Certifications (e.g. AZ-104, AZ-900)

Manage Azure Identities and Governance (AZ-104) (Microsoft Azure Certifications (e.g. AZ-104, AZ-900)) FAQ