Microsoft Azure Architect Design (AZ-304) Practice Test

Which Azure role would be least appropriate for allowing a group to manage Azure resources without altering role assignments?

1. Owner

2. Contributor

3. Reader

4. Custom Role

The correct answer is: Owner

The least appropriate Azure role for allowing a group to manage Azure resources without altering role assignments is the Owner role. This role provides full management rights to all resources, including the ability to assign roles to others and change role assignments. In contrast, the Contributor role also allows for the management of resources but does not permit changing role assignments. The Reader role is primarily for viewing resources without any management capabilities, making it an even more restricted role. A Custom Role can be tailored to provide specific permissions, including the exclusion of the ability to manage role assignments, offering flexibility based on the needs of the group. Therefore, selecting the Owner role would not effectively restrict the group from altering role assignments, whereas the Contributor role, Reader role, or a well-defined Custom Role would meet the requirement to manage resources without modifying role assignments.