Does Network Contributor Enable Traffic Analytics for Admin1?

AZ-104 By islever Editorial Last updated

Monitor resources in Azure Configure secure access to virtual networks

Short answer

A Assigning Network Contributor at subscription scope gives Admin1 one of the four roles Microsoft accepts for enabling Traffic Analytics.

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might
meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure
subscription.
Solution: You assign the Network Contributor role at the subscription level to Admin1.
Does this meet the goal?
  1. Yes Correct Answer
  2. No

Key Takeaways

The question tests the documented minimum role set for enabling Traffic Analytics, and the trap is confusing resource-management permissions with the separate prerequisites (NSG flow logs, Log Analytics workspace) that Traffic Analytics also needs but that are not part of the requester's role check.

This AZ-104 scenario asks whether assigning the Network Contributor role at subscription scope to Admin1 is sufficient to enable Traffic Analytics for an Azure subscription. Microsoft's Network Watcher documentation confirms that enabling Traffic Analytics requires only one of four subscription-scope roles — Owner, Contributor, Reader, or Network Contributor — so the proposed solution meets the goal.

Common mistake: Learners commonly answer B (No), reasoning that Network Contributor cannot manage Log Analytics workspaces or grant access — but the official prerequisite list explicitly includes Network Contributor as an accepted subscription-scope role for enabling the feature.

Expert Analysis

Why the Answer Is Correct

Microsoft's Traffic Analytics documentation states that to enable the feature your account must hold any one of the following roles at the subscription scope: Owner, Contributor, Reader, or Network Contributor. Because Admin1 is being assigned Network Contributor exactly at subscription scope, the stated requirement is satisfied and the solution is valid. The role lets Admin1 manage the network resources — virtual networks, NSGs, Network Watcher-adjacent objects — that Traffic Analytics consumes, which is the permission the enablement check evaluates.

Why the Other Options Are Wrong

Option B (No) would be correct only if Network Contributor were absent from Microsoft's accepted role list, but it is explicitly named alongside Owner, Contributor, and Reader. The objection that Network Contributor cannot grant access to others (as rsharma007 noted) is irrelevant because the goal is enabling Traffic Analytics, not delegating permissions. Likewise, the argument that Microsoft.OperationalInsights workspace actions are not covered confuses the workspace prerequisites with the requester's role requirement; workspace access is a separate configuration step, not a disqualifier for the role. The observation that a ChatGPT answer said "No" does not override the vendor's documented prerequisites.

Community Comment Notes

mlantonis quoted the official prerequisite line directly — "Your account must have any one of the following Azure roles at the subscription scope: Owner, Contributor, Reader, or Network Contributor" — and concluded Yes, and lodo made the same point from the linked documentation. NaoVaz independently listed the identical four roles, while fedztedz and RithuNethra simply affirmed the correct answer. Wojer argued No because Network Contributor lacks OperationalInsights workspace actions, but that addresses workspace prerequisites rather than the role needed to enable Traffic Analytics.

Official Reference

https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a scenario asks whether a single named role satisfies a feature, check the vendor's documented minimum-role list for that feature before reasoning about what the role cannot do — Network Contributor appears explicitly for Traffic Analytics. Ignore adjacent prerequisites such as NSG flow logs or Log Analytics workspace setup unless the question asks about them.

Frequently Asked Questions

Why is Network Contributor enough to enable Traffic Analytics?

Microsoft lists Owner, Contributor, Reader, and Network Contributor as the accepted subscription-scope roles for enabling Traffic Analytics, so Network Contributor satisfies the check.

Does Network Contributor cover the Log Analytics workspace prerequisite?

No — workspace access is configured separately, but it does not affect the role requirement for the account enabling Traffic Analytics.

More AZ-104 FAQ →

Discussion 91 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 91

  1. mlantonis 👍 147
    Correct Answer: A - Yes Your account must have any one of the following Azure roles at the subscription scope: Owner, Contributor, Reader, or Network Contributor. Network Contributor role - Lets you manage networks, but not access to them. Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. Reference: https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics#user-access-requirements https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
  2. rsharma007 👍 10
    they are two different permissions- a NC role can manage the resources, but he/she can't grant access to those resources to anyone else. That can be done by roles with 'access' permissions such as 'owner'
  3. lodo 👍 8
    At the link you provided is stated: Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor. So answer is Yes
  4. fedztedz 👍 6
    Answer is Correct : "Yes"
  5. twambala 👍 6
    how can yu
Show 25 more comments
  1. Exilic 👍 5 Answered A
    ChatGPT B. No Assigning the Network Contributor role to Admin1 at the subscription level does not meet the goal of enabling Traffic Analytics for the Azure subscription. The Network Contributor role provides permissions to manage network resources, such as virtual networks and network interfaces, but it does not grant the necessary permissions to enable Traffic Analytics. To enable Traffic Analytics for an Azure subscription, you need to assign the Log Analytics Contributor or the Network Watcher Contributor role to Admin1 at the subscription level. These roles provide the necessary permissions to configure and enable Traffic Analytics.
  2. NaoVaz 👍 5 Answered A
    A) "Yes" One of the following Azure built-in roles needs to be assigned to your account: - Owner - Contributor - Reader - Network Contributor
  3. Wojer 👍 4 Answered B
    Traffic analytics requires the following prerequisites: -A Network Watcher enabled subscription. -NSG flow logs enabled for the network security groups you want to monitor or VNet flow logs enabled for the virtual network you want to monitor. -An Azure Log Analytics workspace (1)with read and write access. (1)Network contributor doesn't cover Microsoft.OperationalInsights/workspaces/* actions.
  4. zr79 👍 4
    This is another bad architecture from Microsoft. How do you give access to assign the required role to enable Traffic Analytics on a reader role? Reader role should just be able to read (view) and not enable things
  5. GryffindorOG 👍 4
    The subscription level is higher than the resource group level.
  6. Jakub4444 👍 3 Answered B
    No, this does not meet the goal. The Network Contributor role allows managing network resources (such as virtual networks, network interfaces, and network security groups), but it does not provide the required permissions to enable Traffic Analytics. To enable Traffic Analytics, the user must have the Reader or Contributor role at the subscription level to access traffic data and must also have the Log Analytics Contributor role on the Log Analytics workspace where the traffic analytics data is stored. Correct Solution: Assign the Log Analytics Contributor role to Admin1 on the Log Analytics workspace used for Traffic Analytics.
  7. kklohit 👍 3 Answered B
    No, assigning the Network Contributor role at the subscription level to Admin1 does not meet the goal of enabling Traffic Analytics. The Network Contributor role provides the ability to manage network resources, but it does not include the necessary permissions to configure Traffic Analytics. To enable Traffic Analytics, Admin1 needs to be assigned the Network Contributor role on the resource group where the virtual network that is being monitored by Traffic Analytics is located, and also needs to have read permissions to the storage account where the Traffic Analytics data is stored.
  8. abhikeshu 👍 3 Answered A
    as Microsoft document Allowed Roles Owner, Contributor, Network contributor (1) and Monitoring contributor (2), 1. Network contributor doesn't cover Microsoft.OperationalInsights/workspaces/* actions. 2. Only required when using traffic analytics to analyze VNet flow logs (preview). For more information, see Data collection rules in Azure Monitor and Data collection endpoints in Azure Monitor.
  9. wolf13 👍 3
    Your account must have any one of the following Azure roles at the subscription scope: Owner, Contributor, or Network Contributor. The Reader role, only allows the user to view existing resources but does not grant permission to create, modify, or delete them. Therefore, assigning the Reader role to Admin1 does not meet the goal of enabling Traffic Analytics for the Azure subscription.
  10. ozansenturk 👍 3 Answered B
    Network contributor and Monitoring contributor Network contributor doesn't cover Microsoft.OperationalInsights/workspaces/ actions. https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas#prerequisites
  11. CraigB83 👍 3
    User access requirements Your account must be a member of one of the following Azure built-in roles: USER ACCESS REQUIREMENTS Deployment model Role Resource Manager Owner Contributor Reader Network Contributor
  12. Mehedi007 👍 3 Answered A
    https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics#prerequisites https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#network-contributor
  13. Bambi0074 👍 3 Answered B
    https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas#prerequisites Tested in Lab, you need "Network contributor" and "Monitoring contributor"
  14. OmarMac 👍 3
    It's correct - https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics
  15. ZUMY 👍 3
    A is correct!
  16. learnboy123 👍 3 Answered B
    b
  17. LauLauLauw 👍 2
    I'm not 100% sure on the answers, they ask the role to enable Traffic Analytics for an Azure subscription. Traffic Analytics requires: A Network Watcher enabled subscription. For more information, see Create an Azure Network Watcher instance Network Security Group (NSG) flow logs enabled for the NSGs you want to monitor. For more information, see Enable NSG flow log. An Azure Storage account to store raw flow logs. For more information, see Create a storage account An Azure Log Analytics workspace with read and write access. For more information, see Create a Log Analytics workspace So to enable traffic analytics you should be able to create an storage account as well. To use Traffic Analytics one of the following roles should be assigned as well: Owner Contributor Reader Network Contributor
  18. Cg007 👍 2 Answered B
    Assigning the Network Contributor role to Admin1 at the subscription level does not meet the goal of enabling Traffic Analytics for the Azure subscription. The Network Contributor role allows users to manage network resources, such as virtual networks and subnets, but it does not grant permissions to enable Traffic Analytics specifically. To enable Traffic Analytics, Admin1 needs permissions related to monitoring and analytics, which are not provided by the Network Contributor role. Instead, Admin1 should be assigned a role that includes permissions to manage monitoring and analytics services, such as the Monitoring Contributor role or a custom role with the necessary permissions to enable Traffic Analytics.
  19. khamrumunnu 👍 2 Answered B
    Correct Answer: B. No Explanation: To enable Traffic Analytics, a user must have read access to NSG flow logs (stored in a storage account), and permissions to configure Network Watcher, Log Analytics workspace, and Traffic Analytics settings. The Network Contributor role does not grant access to the Log Analytics workspace, which is required to enable and configure Traffic Analytics. Why not A. Yes? Because Network Contributor alone cannot configure or write to Log Analytics workspaces, which is a required step in enabling Traffic Analytics.
  20. vikasshetty296 👍 2 Answered A
    Bing Chat "Yes, assigning the Network Contributor role at the subscription level to Admin1 will enable Traffic Analytics for an Azure subscription. However, it is not recommended to assign the Network Contributor role to users who do not require it as it grants full access to manage network resources in the subscription. Instead, you can assign the Traffic Analytics Contributor role to Admin1 which allows them to manage Traffic Analytics profiles and Traffic Analytics workspaces"
  21. tars1212 👍 2 Answered B
    To enable Traffic Analytics, Admin1 needs permissions to manage Network Watcher and Log Analytics, which are required for Traffic Analytics. The Network Contributor role grants permissions to manage network resources (e.g., virtual networks, load balancers, network security groups) but does not provide access to Log Analytics workspaces, which are necessary for Traffic Analytics.
  22. examWalker 👍 2
    Answer should be No. Traffic Manager Contributor <> Contributor Your account must meet one of the following to enable traffic analytics: Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor. https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq
  23. Repohunter 👍 2
    https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq Your account must meet one of the following to enable traffic analytics: Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor. The reader role should allow you to enable it
  24. amazonalex 👍 2 Answered B
    Network Contributor alone is not enough to enable Traffic Analytics because Traffic Analytics requires two categories of permissions: 1.Network Watcher Flow Log configuration 2.Log Analytics workspace access (because Traffic Analytics stores and processes data in a workspace) The Network Contributor role only covers 1. not 2.
  25. Fox_Mulder 👍 2 Answered A
    https://learn.microsoft.com/en-us/azure/network-watcher/rbac-permissions#traffic-analytics it can. To ENABLE Traffic Analytics for an Azure subscription, the user account must have one of the following built-in Azure roles assigned at the subscription scope: Owner, Contributor, Reader, or Network Contributor.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Enable SSPR for Entra Identities

S-grade

Assigning Fabric Licenses in Entra ID Free Tenant

S-grade

Which Certificate from Vault1 for WebApp1 TLS?

S-grade

Does Storage Account Encryption Scope Contributor Role Allow Key Regeneration?

S-grade

Practice All AZ-104 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AZ-104 Practice Test →

← Back to AZ-104 Study Guide