Microsoft Azure Administrator Associate AZ-104 Practice Question

Even though Jordan has the 'Storage Account Contributor' role at the subscription level, which grants permissions to create storage accounts, a deny assignment at a lower scope, such as the 'FinanceRG' resource group, overrides higher-level allow assignments. If Jordan is part of a group with a deny assignment for creating storage accounts at the 'FinanceRG' resource group level, this deny assignment takes precedence, preventing him from creating the storage account.

Option 1 is incorrect because role assignments at the subscription level automatically apply to all lower scopes unless overridden. Lacking the role at the resource group scope is not the issue here.

Option 3 is incorrect because the 'Storage Account Contributor' role does include permissions to create storage accounts.

Option 4 is incorrect because while Azure policies can restrict resource creation, the question states there are no resource locks or mentions of policies. The most plausible reason based on the given information is the presence of a deny assignment at the resource group level.