Manage Azure identities and governance
Free Microsoft Certified: Azure Administrator Associate practice — 6 questions on Manage Azure identities and governance, with explanations. No sign-up. Full 12-question mixed test →
A company uses Microsoft Entra ID. The IT helpdesk team must be able to reset passwords and manage licenses only for users in the Marketing department, without being granted directory-wide User Administrator permissions. Which feature should you implement?
Administrative units let you scope directory role assignments (like User Administrator) to a defined subset of users, groups, or devices, exactly what's needed here.
You need to create a custom Azure role that allows a team to read blob data inside storage accounts but must NOT allow them to change storage account network rules or access keys. Which role definition element must you use to grant the blob data read permission?
DataActions govern operations on the data plane, such as reading blob contents, separately from control-plane management operations.
An Azure Policy assignment at the subscription level denies creation of any resource without a CostCenter tag. A project team needs to deploy a short-term test VM without a CostCenter tag for a valid, documented business reason, without removing or modifying the policy assignment for all other resources. What should you configure?
Policy exemptions let you exclude a specific scope from an assignment's evaluation with documented justification, without touching the assignment itself or affecting other resources.
You need to prevent an Azure SQL Database from being deleted while still allowing database administrators to scale the service tier and modify firewall rules. Which resource lock should you apply?
A CanNotDelete lock blocks delete operations only, while still permitting reads and modifications such as scaling tiers or updating firewall rules.
A resource group was deployed via an Azure Blueprint that applied resource locks as part of the artifact. A user with the Owner role assigned at the resource group scope attempts to delete one of the locked resources and receives an authorization error, even though Owner normally includes delete permissions. What is the most likely cause?
Blueprint-applied resource locks generate a system deny assignment that overrides ALL RBAC role assignments, including Owner, for the locked operation.
Which statement correctly differentiates a Microsoft Entra ID role from an Azure RBAC role?
Microsoft Entra ID roles (e.g., Global Administrator, User Administrator) govern the directory itself, while Azure RBAC roles (e.g., Owner, Contributor) govern access to Azure resources at management group, subscription, resource group, or resource scope.
Ready for the real thing?
The full course has two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed answer explanations.
Start my full course on Udemy →