Azure RBAC practice questions with answers
Fifteen free Azure RBAC practice questions with explained answers, written as short scenarios about roles, scopes and the split between Azure roles and Microsoft Entra roles. Azure role-based access control decides who can do what with Azure resources, while Entra roles govern the directory. The topic is tested in AZ-104, AZ-900 and SC-300, among others.
How to use these questions
Try each question before opening the explanation and commit to one letter. Underline the constraint word in the stem, such as “least privilege”, “without granting access” or “only for this resource group”, because it usually separates the right role from a near miss. Read why each wrong option fails, since the same distractors return on real exams. The guide Azure RBAC vs Microsoft Entra roles holds the theory behind these fifteen.
Warm-up: roles, scopes and inheritance
Question 1. An auditor must be able to view every resource in a subscription but must not be able to change anything. Which role at subscription scope meets the requirement?
- A. Contributor
- B. Reader
- C. User Access Administrator
- D. Owner
Show answer
Answer: B
Reader allows viewing all resources and nothing else. Contributor and Owner both allow changes: Contributor manages resources, Owner also assigns roles. User Access Administrator manages who has access and does not grant the ability to view the resources themselves.
Question 2. You assign a team the Contributor role on a subscription. A new resource group is later created in that subscription. What access does the team have to the new resource group?
- A. None until the role is assigned again on the resource group
- B. Reader only
- C. Contributor only on resources created by the team
- D. Contributor, inherited from the subscription
Show answer
Answer: D
Role assignments are inherited down the scope hierarchy (management group, subscription, resource group, resource), so Contributor on the subscription applies to the new resource group automatically. Nothing needs to be reassigned. Inheritance does not skip new groups, and the team does not receive a lesser role on them.
Question 3. A new employee needs to create user accounts and reset passwords for non-administrators in the Microsoft Entra tenant, and nothing else. Which assignment fits with the least privilege?
- A. The User Administrator Microsoft Entra role
- B. The Contributor Azure role on the tenant root management group
- C. The Owner Azure role on the subscription
- D. The Reader Azure role on the tenant root management group
Show answer
Answer: A
Creating users is a directory task, so it needs a Microsoft Entra role such as User Administrator, not an Azure role. Contributor and Owner manage Azure resources and carry no rights over directory users. Reader on the tenant root management group only allows viewing Azure resources.
Question 4. A user is Reader on resource group RG-Sales and also Contributor on the subscription that contains RG-Sales. What can the user do to a virtual machine in RG-Sales?
- A. View it only, because the Reader assignment is more specific
- B. Nothing, because the two assignments conflict
- C. Manage it, because the permissions are added together
- D. Manage it only after removing the Reader assignment
Show answer
Answer: C
Azure RBAC permissions are additive. The user holds the union of all assignments, so the inherited Contributor role allows changing the virtual machine, and the Reader assignment does not restrict it. Only a deny assignment can remove an allowed action. The user is not limited to viewing, and the more specific scope does not win.
Question 5. Which of these Azure roles can assign roles to other users but cannot create or delete resources such as virtual machines?
- A. Owner
- B. User Access Administrator
- C. Contributor
- D. Reader
Show answer
Answer: B
User Access Administrator manages user access to Azure resources and has no rights to create or delete the resources. Owner can both assign roles and manage resources, Contributor manages resources but cannot assign roles, and Reader can only view.
Scenarios: least privilege in practice
Question 6. A developer must create and manage virtual machines in resource group RG-App but must not be able to manage the virtual network or storage accounts that the machines use, and must not be able to grant access. Which assignment is the best fit?
- A. Virtual Machine Contributor on RG-App
- B. Contributor on RG-App
- C. Owner on RG-App
- D. Reader on RG-App
Show answer
Answer: A
Virtual Machine Contributor lets a user create and manage virtual machines but not the virtual network or storage account they connect to, and it cannot grant access. Assigning it at RG-App keeps the scope narrow. Contributor and Owner reach the network and storage resources too, and Owner can grant access. Reader cannot create anything.
Question 7. Forty engineers need Contributor on resource group RG-Platform, and the membership changes monthly. What is the most maintainable way to assign access?
- A. Create forty individual Contributor assignments on RG-Platform
- B. Share one account among the engineers
- C. Assign Contributor on RG-Platform to a security group and manage its members
- D. Assign Contributor on the subscription to each engineer
Show answer
Answer: C
Assigning the role once to a Microsoft Entra security group means that membership changes are made in the group and no role assignment needs editing. Forty individual assignments multiply the work, a shared account removes individual accountability, and assigning at subscription scope exceeds the required scope.
Question 8. A helpdesk lead must be able to restart virtual machines in resource group RG-Web, but must not be able to create, resize or delete them. No built-in role is limited to that. What should you do?
- A. Assign Virtual Machine Contributor on RG-Web
- B. Assign Contributor on RG-Web
- C. Assign Reader on RG-Web
- D. Create a custom role with the read and restart actions and assign it on RG-Web
Show answer
Answer: D
A custom role that includes read and the restart action for virtual machines, assigned at RG-Web, meets the requirement exactly. Virtual Machine Contributor also allows creating and deleting machines, Contributor allows far more, and Reader cannot restart anything.
Question 9. A custom role has the action Microsoft.Storage/* and the NotAction Microsoft.Storage/storageAccounts/delete. A user holds this role on RG-Data and also holds the built-in Contributor role on RG-Data. Can the user delete a storage account in RG-Data?
- A. No, the NotAction blocks the deletion
- B. Yes, because Contributor allows it
- C. No, because the two roles conflict
- D. Yes, but only after the custom role is removed
Show answer
Answer: B
NotActions are not a deny: they only subtract actions from that role’s own allowed set. Contributor grants all actions apart from a few such as authorization writes, so it still allows deleting storage accounts, and permissions from both roles are added. Only a deny assignment would block the action.
Question 10. A helpdesk team must reset passwords only for users who belong to the Sales department administrative unit, not for the rest of the tenant. How should the role be assigned?
- A. Assign the Helpdesk Administrator role at tenant scope
- B. Assign Contributor on a resource group
- C. Assign the Helpdesk Administrator role scoped to the Sales administrative unit
- D. Assign Owner on the subscription
Show answer
Answer: C
Microsoft Entra roles can be scoped to an administrative unit, so assigning Helpdesk Administrator or Password Administrator with the Sales administrative unit as scope limits the reach. A resource group scope applies to Azure roles, not directory objects. Tenant-wide scope exceeds the requirement, and Azure roles do not reset passwords.
Edge cases and traps
Question 11. Administrators should hold the Owner role on a production subscription only while they work on it, for a limited time, with an approval step. What should you configure?
- A. An eligible Owner assignment in Privileged Identity Management with approval required
- B. A permanent Owner assignment
- C. A custom role that expires after a day
- D. A deny assignment that is removed on request
Show answer
Answer: A
Privileged Identity Management supports eligible assignments of Azure roles that must be activated, with a time limit and optional approval. A permanent Owner assignment is always active. A custom role cannot add time limits or approval, and a deny assignment cannot be created by administrators for this purpose.
Question 12. An application on a virtual machine must read blobs in one storage account using Microsoft Entra authentication and a managed identity, with no stored secrets and the least privilege. Which role assignment completes the setup?
- A. Reader on the storage account
- B. Storage Blob Data Reader on the storage account
- C. Contributor on the resource group
- D. Owner on the subscription
Show answer
Answer: B
Reading blob data is a data action, which Storage Blob Data Reader grants, here scoped to the storage account. Reader on the account covers only management-plane viewing, not the data. Contributor and Owner on the resource group are far broader than needed, and Contributor gives no blob data actions for Entra authentication.
Question 13. A user is Contributor on RG-App and tries to give a colleague the Reader role on the same resource group. The operation fails. Why?
- A. The colleague must first be assigned an Entra role
- B. Reader can only be assigned at subscription scope
- C. A resource group cannot hold role assignments
- D. Contributor does not include the right to create role assignments
Show answer
Answer: D
Contributor excludes the actions that write role assignments (Microsoft.Authorization/*/Write), so it cannot grant access. Only roles such as Owner, User Access Administrator or Role Based Access Control Administrator can. The failure is not caused by the colleague’s account, by the scope being too small, or by a missing Entra role.
Question 14. You are a Global Administrator. You enabled Access management for Azure resources to regain control of a subscription, and assigned Owner on it to a new administrator. What should you do next?
- A. Remove your elevated access once the assignment is made
- B. Make the new administrator a Global Administrator as well
- C. Leave the elevated access in place for future recovery
- D. Delete the subscription and recreate it
Show answer
Answer: A
The elevation gives you the User Access Administrator role at root scope across all subscriptions. It is intended for recovery, so after the task it should be removed. Leaving it in place keeps a powerful standing permission. Making the new administrator a Global Administrator, deleting the subscription or disabling the tenant is unnecessary and harmful.
Question 15. A custom role was created with the assignable scope /subscriptions/A. A team now wants to assign the role in subscription B. What must be done?
- A. Assign the role in B and ignore the warning
- B. Assign Owner in B instead, which uses the same actions
- C. Update the role definition so that subscription B is in its assignable scopes
- D. Edit the existing assignment in A to point to B
Show answer
Answer: C
AssignableScopes defines where a custom role can be assigned. To use the role in subscription B, the role definition must be updated to include subscription B (or a management group above both). Creating a duplicate assignment, using Owner or editing the assignment itself does not extend the role’s assignable scopes.
Where to go next
Review the theory in Azure RBAC vs Microsoft Entra roles, then continue with Conditional Access practice questions and Zero Trust and IAM practice questions. The free 20-question AZ-104 practice test mixes this topic with the rest of the exam, and multiple-choice exam tips cover how to handle the constraint words.