If you have worked through the AZ-104 curriculum, you have probably hit the lab on managing subscriptions and RBAC through management groups. On paper, it looks like a checklist: create a management group, assign a built-in role, clone a role and exclude a permission, check the Activity Log.
What the lab actually covers
Stripped down, the lab teaches five things:
- Management groups — a container above subscriptions that lets you apply access and policy once, with inheritance downward.
- Built-in roles — pre-defined permission sets like Virtual Machine Contributor, assigned to a group instead of a person.
- Custom roles — cloning an existing role and excluding a permission you don't want granted (shown in the role's JSON as a NotAction).
- PIM "Eligible" assignments — access that exists on paper but must be actively requested and activated.
- The Activity Log — a running record of who did what, and when.
Translating it for a non-technical client
Most business owners don't think in terms of Management Groups or RBAC. So instead of leading with Azure terminology, I lead with a building analogy:
• Management groups are the floors of an office building, organized by department.
• Roles are keycard access levels — a Support keycard opens the server room, not the finance vault.
• Assigning to groups, not individuals, means the keycard is coded to a job role, not a name. When someone leaves, you deactivate their badge — you don't recut every lock in the building.
• PIM-eligible access is a master key kept in a safe. Nobody carries it day-to-day; they sign it out when they need it, and that request is logged.
• A custom role is a specially cut key — it opens almost everything a standard key does, minus the one door that the team shouldn't access.
• The Activity Log is the badge-swipe log at the front desk. You always know who accessed what, and when.
Walking through the Lab
I am following Microsoft's official AZ-104 lab for this.
If you want to try it yourself, it's free and takes about 20 minutes with your own Azure subscription. Here is the sequence, task by task, with the reasoning behind each step.
Task 1 — Create the management group
A management group is a container that lets you apply access and policy once, then have it flow down to every subscription placed inside it.
- Ensure you are logged in to the Azure portal,
- Search for and select Microsoft Entra ID.
- In the Manage blade, select Properties. 4. Search for management groups. 5. On the blade, click Create.
- Enter your management group ID (Must be unique in the directory) and enter the Management group display name (e.g., az104-mg1)
- Refresh the management group page to ensure your new management group displays.
This may take a minute.
Task 2 — Assign a built-in role
Rather than broad Owner access, the lab assigns Virtual Machine Contributor — scoped to managing VMs only to a group, not an individual.
Note: In the following steps, you will assign the role to the helpdesk group. If you do not have a Help Desk group, take a minute to create it.
Select the az104-mg1 management group.
Select the Access control (IAM) blade, and then the Roles tab.
Select + Add. From the drop-down menu, select Add role assignment.
On the Add role assignment blade, search for and select the Virtual Machine Contributor.
The Virtual Machine Contributor role lets you manage virtual machines, but not access their operating system or manage the virtual network and storage account they are connected to. This is a good role for the Help Desk. Select Next.On the Members tab, Select Members.
Search for and select the helpdesk group. Click Select, then click Next. 7. On the Conditions tab, click Next. 8. On the Assignment type tab, leave the assignment type as Eligible and the time-bound settings at their defaults, then click Next.
Click Review + assign to create the role assignment.
Continue on the Access control (IAM) blade. On the Role assignments tab, confirm the helpdesk group has the Virtual Machine Contributor role.
Task 3 — Build a custom role
The lab clones Support Request Contributor and excludes one permission — registering a support resource provider. That exclusion becomes a NotAction in the role's JSON: "everything this role normally allows, minus this one thing."
- Continue working on your management group. Navigate to the Access control (IAM) blade.
- Select + Add. From the drop-down menu, select Add custom role.
On the Basics tab, complete the configuration.
Setting Value
Custom role name Custom Support Request
Description A custom contributor role for support requests.For Baseline permissions, select Clone a role. In the Role to clone drop-down menu, select Support Request, Contributor.
Select Next to move to the Permissions tab, and then select + Exclude permissions. 6. In the resource provider search field, enter. Support and select Microsoft.Support.
In the list of permissions, place a checkbox next to Other: Registers Support Resource Provider and then select Add. The role should be updated to include this permission as a NotAction.
On the Assignable scopes tab, ensure your management group is listed, then click Next.
Review the JSON for the Actions, NotActions, and AssignableScopes that are customized in the role.
Select Review + Create, and then select Create.
Note: An Azure resource provider is a set of REST operations that enable functionality for a specific Azure service. We do not want the Help Desk to be able to have this capability, so it is being removed from the cloned role.
Task 4 — Check the Activity Log
Confirm the work by filtering the management group's Activity Log down to role-assignment events — the same log you did later point a client to as proof of an auditable access-change process.
In the portal, locate the az104-mg1 resource and select Activity log. The activity log provides insight into subscription-level events.
Review the activities for role assignments. The activity log can be filtered for specific operations.
Three Lessons I Learned
After completing this lab and thinking about how I did apply it in a real consulting engagement, these are my biggest takeaways:
RBAC is about reducing risk, not restricting people. The goal is to give users the access they need—and nothing more.
Management Groups make governance scalable. Instead of configuring each subscription individually, you can manage access and policies consistently across your Azure environment.
Clients care less about Azure terminology than about protecting their business. My role as a consultant is to translate technical concepts into business value, helping clients understand how Azure improves security, accountability, and operational efficiency.
Clean up your resources
If you are working with your own subscription, take a minute to delete the lab resources. This will ensure resources are freed up and costs are minimized. The easiest way to delete the lab resources is to delete the lab resource group.
If this guide helps in any way, kindly share. I did be glad to hear your thoughts.
