Microsoft AZ-104 Exam With Confidence Using Practice Dumps

 Stored access policies: ✅ 2

 Immutable blob storage policies: ✅ 1

From the scenario in the earlier case study (A. Datum Corporation):

The planned change requires creating a new container named cont2 in storage1, with the following:

Three stored access policies (Stored1, Stored2, Stored3)

A legal hold for immutable blob storage

Also, recall from the table:

storage1 has Hierarchical namespace = Yes (Data Lake Storage Gen2 enabled).

storage2 has Hierarchical namespace = No.

The question asks: “What is the maximum number of additional access policies you can create for cont2?”

According to Microsoft Azure Storage documentation:

A blob container can have a maximum of five stored access policies.

These policies allow shared access signatures (SAS) to be managed centrally, letting you define start times, expiry times, and permissions at the container level.

Since three stored access policies (Stored1, Stored2, Stored3) already exist, the maximum additional policies that can still be created is:

→ 5 (maximum allowed) – 3 (already existing) = 2

For immutable blob storage policies:

A container can have one active immutability policy at a time.

This can be either a time-based retention policy or a legal hold policy.

Since cont2 already has a legal hold applied, no additional immutable policy can coexist with it, but it can have one defined policy type (the legal hold).

Therefore:

Stored access policies: 2 additional policies can still be created.

Immutable blob storage policies: 1 policy (the existing legal hold).

This aligns exactly with Microsoft Learn: Azure Storage Blob Service limits and immutable storage documentation:

“A container may have up to five stored access policies. Immutable storage supports either a time-based retention policy or legal hold policy per container.”

Final Verified Answer:

✅ Stored access policies: 2

✅ Immutable blob storage policies: 1

 Users: Admin1 and Admin2 only

 Group: Group1, or Group3

In Microsoft Entra ID (Azure Active Directory), Self-Service Password Reset (SSPR) is configured at the tenant level and can be scoped either to all users or to selected groups. Both who can configure SSPR and which groups are eligible are strictly defined by Microsoft Entra role permissions and group support rules.

Who can configure SSPR

Microsoft Entra documentation clearly states that only the following administrative roles are authorized to configure and manage SSPR settings:

Global Administrator

Authentication Policy Administrator

In this scenario:

Admin1 is a Global Administrator → ✅ Allowed

Admin2 is an Authentication Policy Administrator → ✅ Allowed

Admin3 holds Authentication Administrator and Security Administrator roles → ❌ These roles cannot configure SSPR policies

Microsoft explicitly distinguishes authentication method management from SSPR policy configuration, which is why Authentication Administrators and Security Administrators do not have permission to configure SSPR.

✔ Correct Users selection: Admin1 and Admin2 only

Which groups can have SSPR enabled

When enabling SSPR for Selected users, Microsoft Entra supports only assigned membership security-based groups.

According to Microsoft documentation:

Security groups (Assigned) → ✅ Supported

Mail-enabled security groups (Assigned) → ✅ Supported

Microsoft 365 groups → ❌ Not supported

Dynamic groups → ❌ Not supported

Applying this to the provided groups:

Group1 – Security, Assigned → ✅ Eligible

Group2 – Microsoft 365, Dynamic → ❌ Not eligible

Group3 – Mail-enabled security, Assigned → ✅ Eligible

✔ Correct Group selection: Group1 or Group3 only

Final Answer Summary

Section

Correct Selection

Users

Admin1 and Admin2 only

Group

Group1 or Group3 only

Microsoft Entra Administrator documentation extract:

“Only Global Administrators and Authentication Policy Administrators can configure self-service password reset settings.”

“SSPR can be enabled for security groups and mail-enabled security groups with assigned membership. Dynamic groups and Microsoft 365 groups are not supported.”

✅ Final Verified Answer:

Users: Admin1 and Admin2 only

Group: Group1 or Group3 only