Does Network Contributor Enable Traffic Analytics for Admin1?

Monitor resources in Azure Configure secure access to virtual networks

Answer Correct answer: A — Assigning Network Contributor at subscription scope gives Admin1 one of the four roles Microsoft accepts for enabling Traffic Analytics.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription. Solution: You assign the Network Contributor role at the subscription level to Admin1. Does this meet the goal?

Yes Correct Answer
No

Community Insight

The question tests the documented minimum role set for enabling Traffic Analytics, and the trap is confusing resource-management permissions with the separate prerequisites (NSG flow logs, Log Analytics workspace) that Traffic Analytics also needs but that are not part of the requester's role check.

This AZ-104 scenario asks whether assigning the Network Contributor role at subscription scope to Admin1 is sufficient to enable Traffic Analytics for an Azure subscription. Microsoft's Network Watcher documentation confirms that enabling Traffic Analytics requires only one of four subscription-scope roles — Owner, Contributor, Reader, or Network Contributor — so the proposed solution meets the goal.

Learners commonly answer B (No), reasoning that Network Contributor cannot manage Log Analytics workspaces or grant access — but the official prerequisite list explicitly includes Network Contributor as an accepted subscription-scope role for enabling the feature.

Community Discussion (94 comments)

Fox_Mulder 👍 2 Selected: A

https://learn.microsoft.com/en-us/azure/network-watcher/rbac-permissions#traffic-analytics it can. To ENABLE Traffic Analytics for an Azure subscription, the user account must have one of the following built-in Azure roles assigned at the subscription scope: Owner, Contributor, Reader, or Network Contributor.

dbrv 👍 1 Selected: B

My answer: NO https://learn.microsoft.com/en-us/azure/network-watcher/rbac-permissions#traffic-analytics As per docs: 1. Network contributor doesn't include the following actions: Microsoft.Storage/ actions listed in Additional actions or Flow logs section. Microsoft.Compute/ actions listed in Additional actions section. Microsoft.OperationalInsights/workspaces/, Microsoft.Insights/dataCollectionRules/, or Microsoft.Insights/dataCollectionEndpoints/* actions listed in Traffic analytics section. 2. enabling TRAFFIC ANALYTICS is part of the FLOW LOG resource, you need the following permissions in addition to all the required permissions for Flow logs ...

Fox_Mulder 👍 1

read carefully. To ENABLE Traffic Analytics for an Azure subscription, the user account must have one of the following built-in Azure roles assigned at the subscription scope: Owner, Contributor, Reader, or Network Contributor. List of the flow log actions are mainly GET operations with some other. To ENABLE YOU NEED ROLE not an actions..

MIGO86 👍 2 Selected: A

A. Yes Assigning Network Contributor at the subscription level to Admin1 meets the goal. For Azure Network Watcher Traffic Analytics, one of the acceptable built-in roles at the subscription scope is Owner, Contributor, or Network Contributor.

3lVhylla 👍 1 Selected: A

Minimum Requirements to Enable Traffic Analytics To enable Traffic Analytics, the user needs permissions to: Register the insight provider → Microsoft.Insights Access Network Watcher → Read/write on Network Watcher Configure NSG Flow Logs → Read/write on NSGs Access Storage Account → For flow log storage so the answer is: YES

amazonalex 👍 2 Selected: B

Network Contributor alone is not enough to enable Traffic Analytics because Traffic Analytics requires two categories of permissions: 1.Network Watcher Flow Log configuration 2.Log Analytics workspace access (because Traffic Analytics stores and processes data in a workspace) The Network Contributor role only covers 1. not 2.

Chrissy102 👍 2 Selected: B

no is correct.

621d4ae 👍 1 Selected: B

Analysis Assigning Network Contributor only gives access to network resources. It does not allow enabling Traffic Analytics because it lacks permissions to: Configure NSG flow logs Write to Log Analytics workspace Conclusion Does the solution meet the goal? ❌ No, it is insufficient.

BiniJacob 👍 2 Selected: A

According to the official Microsoft Learn documentation, the Network Contributor role is sufficient.

4cd4615 👍 1 Selected: B

The Network Contributor role allows managing network resources (such as virtual networks, network interfaces, and network security groups), but it does not provide the required permissions to enable Traffic Analytics.

4cd4615 👍 1 Selected: B

B - To enable Traffic Analytics, the user must have: Write access to NSGs and Diagnostic Settings Permissions to configure Log Analytics workspaces Either: The Owner or Contributor role on the subscription/resource group Or a custom role that includes: Microsoft.Network/networkSecurityGroups/write Microsoft.Insights/diagnosticSettings/ Microsoft.OperationalInsights/workspaces/

Sahar_A 👍 1 Selected: B

Enabling Traffic Analytics requires both network and Log Analytics permissions; Network Contributor alone is insufficient. ChatGPT answered after being challenged its original A answer

fensitutor 👍 1 Selected: B

To enable Traffic Analytics in Azure, a user needs permission to: Configure Network Watcher. Enable NSG flow logs. Access and configure Log Analytics. The Network Contributor role: Can manage networking resources, including NSGs and Network Watcher. Cannot manage Log Analytics workspaces, which are required for Traffic Analytics. Correct Answer: B. No Because the Network Contributor role alone does not grant permissions to configure Log Analytics, it does not fully meet the goal. To fully enable Traffic Analytics, Admin1 would need additional permissions (such as Log Analytics Contributor). Traffic analytics overview & prerequisites https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics#prerequisites Required RBAC permissions for Traffic Analytics https://learn.microsoft.com/en-us/azure/network-watcher/required-rbac-permissions#traffic-analytics Community Q&A confirmation https://learn.microsoft.com/en-us/answers/questions/1659185/is-the-reader-role-at-the-sub-level-could-enable-t

ea7e15a 👍 1 Selected: A

HERE IS WHY: Network Contributor role provides permissions to manage network resources, including enabling Traffic Analytics, which is part of Network Watcher. Assigning this role at the subscription level gives Admin1 sufficient access to enable Traffic Analytics across the subscription. Also if it is mentioned that User is an Admin1 which means he is more likely in Admin group that will allow him to perform Traffic Analysis.

kjbalamurugan 👍 1 Selected: B

To successfully enable and configure Traffic Analytics, the user (e.g., Admin1) typically needs the following roles: 1. Network Contributor 2. Log Analytics Contributor.

ea7e15a 👍 1

Its states that user "Admin1" is assigned to Network Contributor in subscription level. Overall it seem like he has capabilities but limited.

Abcdefgijklmno 👍 1 Selected: B

B is correct answer

khamrumunnu 👍 2 Selected: B

Correct Answer: B. No Explanation: To enable Traffic Analytics, a user must have read access to NSG flow logs (stored in a storage account), and permissions to configure Network Watcher, Log Analytics workspace, and Traffic Analytics settings. The Network Contributor role does not grant access to the Log Analytics workspace, which is required to enable and configure Traffic Analytics. Why not A. Yes? Because Network Contributor alone cannot configure or write to Log Analytics workspaces, which is a required step in enabling Traffic Analytics.

marek_jazz 👍 1 Selected: B

To enable Traffic Analytics, you need permissions for: Network Watcher and NSG Flow Logs "Microsoft.Network/networkWatchers/" "Microsoft.Network/networkSecurityGroups/" Diagnostic settings (to send data to Log Analytics) "Microsoft.Insights/diagnosticSettings/" Log Analytics workspace access "Microsoft.OperationalInsights/workspaces/"

rah_rule100 👍 1 Selected: A

Correct answer is A

ahmadsaquib 👍 1 Selected: B

No, assigning the Network Contributor role at the subscription level to Admin1 does not meet the goal of enabling Traffic Analytics. Why? Traffic Analytics requires permissions to: Read Azure network data (e.g., NSG flow logs). Write to a Log Analytics workspace (to store and analyze traffic data). The Network Contributor role only grants permissions to manage Azure networking resources (e.g., VNets, NSGs) but does not include: Access to Log Analytics workspaces. Required permissions for Traffic Analytics (e.g., Microsoft.OperationalInsights/workspaces/*).

tars1212 👍 2 Selected: B

To enable Traffic Analytics, Admin1 needs permissions to manage Network Watcher and Log Analytics, which are required for Traffic Analytics. The Network Contributor role grants permissions to manage network resources (e.g., virtual networks, load balancers, network security groups) but does not provide access to Log Analytics workspaces, which are necessary for Traffic Analytics.

lumax007 👍 1 Selected: A

To use Traffic analytics, you must assign one of the following Azure built-in roles to your account: Deployment model Role Resource Manager Owner Contributor Network contributor 1 and Monitoring contributor 1 Network contributor doesn't cover Microsoft.OperationalInsights/workspaces/* actions. If none of the preceding built-in roles are assigned to your account, assign a custom role that supports the actions listed in Flow logs and Traffic analytics permissions. https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas

BUDSENA 👍 2 Selected: B

You need monitor contributor and network contributor.

Jakub4444 👍 3 Selected: B

No, this does not meet the goal. The Network Contributor role allows managing network resources (such as virtual networks, network interfaces, and network security groups), but it does not provide the required permissions to enable Traffic Analytics. To enable Traffic Analytics, the user must have the Reader or Contributor role at the subscription level to access traffic data and must also have the Log Analytics Contributor role on the Log Analytics workspace where the traffic analytics data is stored. Correct Solution: Assign the Log Analytics Contributor role to Admin1 on the Log Analytics workspace used for Traffic Analytics.

Bambi0074 👍 3 Selected: B

https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas#prerequisites Tested in Lab, you need "Network contributor" and "Monitoring contributor"

ozansenturk 👍 3 Selected: B

Network contributor and Monitoring contributor Network contributor doesn't cover Microsoft.OperationalInsights/workspaces/ actions. https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas#prerequisites

ozansenturk 👍 1

rectify my answer: just to enable the built in role network contributor will be sufficient. the answer is A

58b2872 👍 1 Selected: A

assigning the Network Contributor role to the user at the appropriate level (e.g., subscription or resource group) will provide sufficient permissions to enable and configure Traffic Analytics.

RajeshwaranM 👍 1 Selected: B

Answer from ChatGPT : Why "Network Contributor" is Insufficient? While the Network Contributor role allows managing NSGs, it does not include permissions to enable diagnostics or configure Log Analytics settings. By assigning the Contributor role or combining the above permissions in a custom role, you can accomplish this task. Let me know if you need further clarification or examples!

Miniappa 👍 1 Selected: A

A is correct as per recent Microsoft documentation https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics#prerequisites

srini77923 👍 1

it should have both network and monitoring contributor role so the answers is B

RVivek 👍 2 Selected: B

Monitoring contributor role is also required, along with Network Contributor https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics#prerequisites https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics#key-components

dirkxi 👍 1

Network Watcher can be applied in various scenarios to ensure network integrity and performance: Enabling Traffic Analytics: Assigning roles such as Owner, Contributor, or Network Contributor at the subscription level to enable traffic analytics. A is indeed correct!

Exilic 👍 5 Selected: A

ChatGPT B. No Assigning the Network Contributor role to Admin1 at the subscription level does not meet the goal of enabling Traffic Analytics for the Azure subscription. The Network Contributor role provides permissions to manage network resources, such as virtual networks and network interfaces, but it does not grant the necessary permissions to enable Traffic Analytics. To enable Traffic Analytics for an Azure subscription, you need to assign the Log Analytics Contributor or the Network Watcher Contributor role to Admin1 at the subscription level. These roles provide the necessary permissions to configure and enable Traffic Analytics.

blackwhites 👍 1

Answer A es, this meets the goal. The Network Contributor role at the subscription level allows users to manage network resources, including enabling Traffic Analytics. Here are the steps on how to assign the Network Contributor role to Admin1: Go to the Azure portal. In the left navigation pane, select Roles and subscriptions. In the Subscriptions tab, select the subscription that you want to assign the role to. In the Roles tab, select Add role assignment. In the Select a role dialog box, select Network Contributor. In the Select users or groups dialog box, enter the name of the user or group that you want to assign the role to. Select the Select button. In the Review + assign dialog box, review the role assignment, and then select the Assign button. Once you have assigned the Network Contributor role to Admin1, they will be able to enable Traffic Analytics for the Azure subscription.

Matsane 👍 1

A is the correct answer

abhikeshu 👍 3 Selected: A

as Microsoft document Allowed Roles Owner, Contributor, Network contributor (1) and Monitoring contributor (2), 1. Network contributor doesn't cover Microsoft.OperationalInsights/workspaces/* actions. 2. Only required when using traffic analytics to analyze VNet flow logs (preview). For more information, see Data collection rules in Azure Monitor and Data collection endpoints in Azure Monitor.

bobothewiseman 👍 2 Selected: A

Correct Answer: A - Yes

tashakori 👍 1

Yes is right

Cg007 👍 2 Selected: B

Assigning the Network Contributor role to Admin1 at the subscription level does not meet the goal of enabling Traffic Analytics for the Azure subscription. The Network Contributor role allows users to manage network resources, such as virtual networks and subnets, but it does not grant permissions to enable Traffic Analytics specifically. To enable Traffic Analytics, Admin1 needs permissions related to monitoring and analytics, which are not provided by the Network Contributor role. Instead, Admin1 should be assigned a role that includes permissions to manage monitoring and analytics services, such as the Monitoring Contributor role or a custom role with the necessary permissions to enable Traffic Analytics.

Wojer 👍 4 Selected: B

Traffic analytics requires the following prerequisites: -A Network Watcher enabled subscription. -NSG flow logs enabled for the network security groups you want to monitor or VNet flow logs enabled for the virtual network you want to monitor. -An Azure Log Analytics workspace (1)with read and write access. (1)Network contributor doesn't cover Microsoft.OperationalInsights/workspaces/* actions.

kond 👍 1

just to enable trafic analytics network contributor role is enough ? - Copilot says NO, assigning the Network Contributor role is not enough to enable Traffic Analytics for an Azure subscription. The Network Contributor role provides permissions related to network resources, but it does not specifically grant access to configure or manage Traffic Analytics settings. To achieve the goal, you should assign the appropriate role related to Traffic Analytics, such as Log Analytics Contributor or Network Watcher Contributor. These roles provide the necessary permissions to enable and manage Traffic Analytics effectively.

learnboy123 👍 3 Selected: B

Gpsn 👍 1

It clearly states that Network Contributor role can access Traffic Analytics. So answer should be A - Yes. https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics#prerequisites One of the built in roles - Owner, Contributor, Network contributor, Monitoring contributor

mtc9 👍 1

is subscription-level Reader role enough to modify network settings?

GODUSGREAT 👍 1

No , you won't be able manage it

Basimane_1 👍 1

MORNING GUYS WHATED TO ASK WHY ARE THEY SAYING THIS ...these questions will not appear in the review screen.?

Mehedi007 👍 3 Selected: A

https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics#prerequisites https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#network-contributor

Shirsangshu 👍 1

Thanks a ton for the comments

wolf13 👍 3

Your account must have any one of the following Azure roles at the subscription scope: Owner, Contributor, or Network Contributor. The Reader role, only allows the user to view existing resources but does not grant permission to create, modify, or delete them. Therefore, assigning the Reader role to Admin1 does not meet the goal of enabling Traffic Analytics for the Azure subscription.

Patesso 👍 1

Tout a fait d'avis avec toi!

Athul07 👍 1

B. No Assigning the Network Contributor role at the subscription level to Admin1 does not meet the goal of enabling Traffic Analytics for the Azure subscription. To enable Traffic Analytics, the user needs to have the Network Contributor role at the resource group level or higher. Assigning the Network Contributor role at the subscription level is not sufficient to enable Traffic Analytics specifically. Therefore, the provided solution does not meet the goal.

GryffindorOG 👍 4

The subscription level is higher than the resource group level.

RandomNickname 👍 2 Selected: A

Looks like A is correct;

vikasshetty296 👍 2 Selected: A

Bing Chat "Yes, assigning the Network Contributor role at the subscription level to Admin1 will enable Traffic Analytics for an Azure subscription. However, it is not recommended to assign the Network Contributor role to users who do not require it as it grants full access to manage network resources in the subscription. Instead, you can assign the Traffic Analytics Contributor role to Admin1 which allows them to manage Traffic Analytics profiles and Traffic Analytics workspaces"

hz78 👍 1

Answer NO. Assigning the Network Contributor role to Admin1 will enable them to manage network resources, but it will not provide the necessary permissions to enable Traffic Analytics for the Azure subscription. To enable Traffic Analytics, Admin1 must be assigned the required permissions, which can be achieved by assigning the Log Analytics Contributor role to Admin1 at the subscription level or by assigning the Network Watcher Contributor role to Admin1 at the resource group level where the Traffic Analytics workspace is located. Therefore, the solution mentioned in the scenario is not sufficient to meet the goal.

kklohit 👍 3 Selected: B

No, assigning the Network Contributor role at the subscription level to Admin1 does not meet the goal of enabling Traffic Analytics. The Network Contributor role provides the ability to manage network resources, but it does not include the necessary permissions to configure Traffic Analytics. To enable Traffic Analytics, Admin1 needs to be assigned the Network Contributor role on the resource group where the virtual network that is being monitored by Traffic Analytics is located, and also needs to have read permissions to the storage account where the Traffic Analytics data is stored.

amiray 👍 2

Correct answer is A Your account must meet one of the following to enable traffic analytics: -> Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor.

LauLauLauw 👍 2

I'm not 100% sure on the answers, they ask the role to enable Traffic Analytics for an Azure subscription. Traffic Analytics requires: A Network Watcher enabled subscription. For more information, see Create an Azure Network Watcher instance Network Security Group (NSG) flow logs enabled for the NSGs you want to monitor. For more information, see Enable NSG flow log. An Azure Storage account to store raw flow logs. For more information, see Create a storage account An Azure Log Analytics workspace with read and write access. For more information, see Create a Log Analytics workspace So to enable traffic analytics you should be able to create an storage account as well. To use Traffic Analytics one of the following roles should be assigned as well: Owner Contributor Reader Network Contributor

Nitin9070 👍 1

Correct Answer: A - Yes

NaoVaz 👍 5 Selected: A

A) "Yes" One of the following Azure built-in roles needs to be assigned to your account: - Owner - Contributor - Reader - Network Contributor

lakart 👍 1

This Microsoft Learn resource is particularly useful when it comes to Azure AD roles:

Lazylinux 👍 2 Selected: A

Agreed A is right as per others comments

manalshowaei 👍 2 Selected: A

A. Yes correct

Repohunter 👍 2

https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq Your account must meet one of the following to enable traffic analytics: Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor. The reader role should allow you to enable it

zr79 👍 4

This is another bad architecture from Microsoft. How do you give access to assign the required role to enable Traffic Analytics on a reader role? Reader role should just be able to read (view) and not enable things

WS_21 👍 2 Selected: A

AzureLearner76 👍 1

My 2 Cents; the answer is correct according to the docs , but why the hell a user with a reader permission can enable anything - this is a bad RCAB design in Azure

PeterHu 👍 1

A is right

Mozbius_ 👍 1

Thank you for clarifying! Much appreciated.

CraigB83 👍 3

User access requirements Your account must be a member of one of the following Azure built-in roles: USER ACCESS REQUIREMENTS Deployment model Role Resource Manager Owner Contributor Reader Network Contributor

rsharma007 👍 10

they are two different permissions- a NC role can manage the resources, but he/she can't grant access to those resources to anyone else. That can be done by roles with 'access' permissions such as 'owner'

twambala 👍 2

how can one manage something if he does not have access to it

jvincent 👍 2

If you provide only network contributor to admin1 then try to enable Traffic Analytics, the Storage Account and Log Analytics Workspace value required to enable it will not be present. Hence, you cannot enable with Network Contributor. Answer is No.

Radhaghosh 👍 1

To enable traffic analytics, your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor. So Answer is Correct

Mich132 👍 1

So normally a Contributor is not allowed to assign a role "Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries." But this is an exception?

mlantonis 👍 147

Correct Answer: A - Yes Your account must have any one of the following Azure roles at the subscription scope: Owner, Contributor, Reader, or Network Contributor. Network Contributor role - Lets you manage networks, but not access to them. Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. Reference: https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics#user-access-requirements https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

twambala 👍 6

how can yu

armandolubaba 👍 1

Correct Answer

ZUMY 👍 3

A is correct!

Sandroal29 👍 1

Given answer is correct.

StixxNSnares 👍 1

toniiv 👍 2

A. is correct (network contributor at subscription scope)

waterzhong 👍 1

Traffic Analytics requires the following prerequisites: A Network Watcher enabled subscription. Network Security Group (NSG) flow logs enabled for the NSGs you want to monitor. An Azure Storage account, to store raw flow logs. An Azure Log Analytics workspace, with read and write access.

ianBrPr 👍 1

In this question we cannot assume prerequisites, it would be convenient to test the three cases. Only the owner could enable Traffic Analytics by himself.

ms70743 👍 1

Answer is Yes.

waterzhong 👍 1

fedztedz 👍 6

Answer is Correct : "Yes"

smw2020 👍 2

Very right. The correct answer is yes.

examWalker 👍 2

Answer should be No. Traffic Manager Contributor <> Contributor Your account must meet one of the following to enable traffic analytics: Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor. https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq

lodo 👍 8

At the link you provided is stated: Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor. So answer is Yes

OmarMac 👍 3

It's correct - https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics

RithuNethra 👍 22

correct answer

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Microsoft's Traffic Analytics documentation states that to enable the feature your account must hold any one of the following roles at the subscription scope: Owner, Contributor, Reader, or Network Contributor. Because Admin1 is being assigned Network Contributor exactly at subscription scope, the stated requirement is satisfied and the solution is valid. The role lets Admin1 manage the network resources — virtual networks, NSGs, Network Watcher-adjacent objects — that Traffic Analytics consumes, which is the permission the enablement check evaluates.

Why the Other Options Are Wrong

Option B (No) would be correct only if Network Contributor were absent from Microsoft's accepted role list, but it is explicitly named alongside Owner, Contributor, and Reader. The objection that Network Contributor cannot grant access to others (as rsharma007 noted) is irrelevant because the goal is enabling Traffic Analytics, not delegating permissions. Likewise, the argument that Microsoft.OperationalInsights workspace actions are not covered confuses the workspace prerequisites with the requester's role requirement; workspace access is a separate configuration step, not a disqualifier for the role. The observation that a ChatGPT answer said "No" does not override the vendor's documented prerequisites.

Community Comment Notes

mlantonis quoted the official prerequisite line directly — "Your account must have any one of the following Azure roles at the subscription scope: Owner, Contributor, Reader, or Network Contributor" — and concluded Yes, and lodo made the same point from the linked documentation. NaoVaz independently listed the identical four roles, while fedztedz and RithuNethra simply affirmed the correct answer. Wojer argued No because Network Contributor lacks OperationalInsights workspace actions, but that addresses workspace prerequisites rather than the role needed to enable Traffic Analytics.

Official Reference

https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics

Exam Strategy

When a scenario asks whether a single named role satisfies a feature, check the vendor's documented minimum-role list for that feature before reasoning about what the role cannot do — Network Contributor appears explicitly for Traffic Analytics. Ignore adjacent prerequisites such as NSG flow logs or Log Analytics workspace setup unless the question asks about them.

Frequently Asked Questions

Why is Network Contributor enough to enable Traffic Analytics?

Microsoft lists Owner, Contributor, Reader, and Network Contributor as the accepted subscription-scope roles for enabling Traffic Analytics, so Network Contributor satisfies the check.

Does Network Contributor cover the Log Analytics workspace prerequisite?

No — workspace access is configured separately, but it does not affect the role requirement for the account enabling Traffic Analytics.

More AZ-104 FAQ →

Related Analysis

Practice All AZ-104 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AZ-104 Practice Test →

← Back to AZ-104 Study Guide