AZ104-Q: RBAC scope precedence
Q: A user is a Reader on a resource group and a Contributor on a management group that contains that resource group. What is the user’s effective permission on the resource group?
- A) Only Reader
- B) Contributor (it inherits from the management group) ✓
- C) Denied — the assignments conflict
- D) Reader and Contributor combined as a single role
Answer: B. RBAC assignments inherit down the scope hierarchy. The Contributor assignment made at the management group (a higher scope) inherits to the resource group, so the effective access on the resource group is Contributor. There is no “conflict” — the more-permissive inherited assignment applies. (Note: a Deny assignment at a child scope could block it, but there is none here.)
Why it helps
This is the single most-tested AZ-104 RBAC concept: scope + inheritance beats per-resource reading.