AZ-104 Question 24
Single answerYou have been asked to grant a support engineer the ability to create and manage all Azure resources within a subscription. However, you must ensure that this engineer cannot assign roles or manage access permissions. Which built-in role should you assign?
- A
Owner
- B
Contributor
- C
Reader
- D
User Access Administrator
Show answer and explanation
Correct answer: B
Explanation
Contributor enables the support engineer to create and manage resources without the authority to assign roles or alter access permissions. Hence, Contributor is the best fit for the requirement.
- A. Incorrect.
Owner role includes full access to all resources, including the ability to assign roles, which exceeds the requirement.
- B. Correct.
Contributor role can create and manage all types of Azure resources but cannot grant or revoke access, meeting the stated requirement.
- C. Incorrect.
Reader role can only view resources and cannot create, modify, or delete them, which is too limited.
- D. Incorrect.
User Access Administrator role focuses on assigning and removing access for other users rather than managing resources, so it does not match the requirement.