AZ-104 Lab Skills: How Azure RBAC and Management Groups Apply in Real Consulting

Microsoft's AZ-104 certification lab covers five core Azure governance concepts: management groups, built-in roles, custom roles, Privileged Identity Management (PIM) eligible assignments, and the Activity Log. Management groups act as containers above subscriptions, allowing access policies to be set once and inherited downward across all child subscriptions. The lab demonstrates assigning the Virtual Machine Contributor role to a helpdesk group at the management group level, rather than granting broad Owner access to individuals. A custom role is also built by cloning the Support Request Contributor role and removing a specific permission using a NotAction in the role's JSON definition. The article argues these technical concepts can be translated into practical consulting engagements by using plain-language analogies, such as comparing management groups to floors of an office building organized by department.