Microsoft
AZ-104 · Question #428
Hotspot Question You have an Azure Active Directory (Azure AD) tenant that contains three global administrators named Admin1, Admin2, and Admin3. The tenant is associated to an Azure subscription. Acc
The correct answer is Admin1 can add Admin 2 as an owner of the subscription. = Yes; Admin3 can add Admin 2 as an owner of the subscription. = Yes; Admin2 can create a resource group in the subscription. = No. 1. Admin1 can add Admin2 as an owner of the subscription. => Yes. The Tenant exhibit shows Admin1, a Global Administrator, has configured "Access management for Azure resources" to "Yes". This setting grants all Global Administrators the "User Access Administrator" role at the ro
Submitted by layla.eg· Mar 4, 2026Manage identities and governance
Question
Hotspot Question You have an Azure Active Directory (Azure AD) tenant that contains three global administrators named Admin1, Admin2, and Admin3. The tenant is associated to an Azure subscription. Access control for the subscription is configured as shown in the Access control exhibit. (Click the Access Control tab.) You sign in to the Azure portal as Admin1 and configure the tenant as shown in the Tenant exhibit. (Click the Tenant tab.) For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:
Exhibits
Answer Area
- Admin1 can add Admin 2 as an owner of the subscription.Yes
- Admin3 can add Admin 2 as an owner of the subscription.Yes
- Admin2 can create a resource group in the subscription.No
Explanation
- Admin1 can add Admin2 as an owner of the subscription. => Yes. The Tenant exhibit shows Admin1, a Global Administrator, has configured "Access management for Azure resources" to "Yes". This setting grants all Global Administrators the "User Access Administrator" role at the root scope of the Azure subscription, which allows them to grant any role, including Owner, to other users. This is consistent with the official explanation that Admin1 'has taken control to manage access to all Azure subscriptions' and 'Can assign role to other users'.
- Admin3 can add Admin2 as an owner of the subscription. => Yes. The Access control exhibit explicitly shows Admin3 is assigned the 'Owner' role for the subscription. The Owner role has full permissions to manage all resources and also delegate access, allowing Admin3 to assign the Owner role to Admin2. This aligns with the official explanation that 'Admin 3 is Global Administrator + Owner of Subscription therefore can assign Owner role to other user'.
- Admin2 can create a resource group in the subscription. => No. Admin2 is a Global Administrator in Azure AD, but this role alone does not grant permissions to manage resources within an Azure subscription. The exhibits do not show Admin2 having any explicit role assignment (like Owner or Contributor) at the subscription level. Therefore, Admin2 lacks the necessary permissions to create a resource group. This is consistent with the official explanation that 'Admin2 is Global Administrator for Tenant and do not have any rights on Subscription therefore cannot create resources in it'.
Topics
#Azure AD roles#Azure RBAC#Tenant settings#Subscription access
Community Discussion
No community discussion yet for this question.