AZ-104 Manage Azure Identities and Governance Practice Question
An enterprise has 30 Azure subscriptions. Production subscriptions need a common baseline of allowed regions, required tags, and approved SKU rules, and any new production subscription must inherit those rules automatically. Sandbox subscriptions should follow a separate, lighter baseline. Which Azure construct should the team use to organize this governance model?
⚠ Common exam trap
Many exam-takers confuse resource groups or resource locks with policy-based governance, failing to recognize that only management groups combined with Azure Policy can enforce a common baseline across multiple subscriptions and automatically apply to new subscriptions placed in the hierarchy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A management group hierarchy with separate production and sandbox branches.
Management groups allow you to build a hierarchy of Azure subscriptions and apply Azure Policy at the management group scope. By creating separate management group branches for production and sandbox, you can assign distinct policy sets (allowed regions, required tags, approved SKUs) to each branch, and any new subscription placed under the production branch will automatically inherit those baseline rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A separate resource group for each business unit inside every subscription.
Why it's wrong here
A separate resource group for each business unit inside every subscription is wrong because resource groups exist only within a single subscription and cannot contain other subscriptions, so they cannot create a common boundary across the 30 subscriptions. Even if every subscription used the same naming pattern, policy and role-based access control would still need to be configured separately in each subscription, since resource groups do not inherit settings from each other. This approach multiplies administrative overhead without providing the enterprise-wide hierarchy that management groups offer.
When this WOULD be correct
A question asks how to isolate resources for different business units within a single subscription, ensuring each unit's resources are logically separated and can be managed independently without affecting others.
- ✓
A management group hierarchy with separate production and sandbox branches.
Why this is correct
A management group hierarchy with separate production and sandbox branches is the correct approach because management groups are Azure's native containers for organizing multiple subscriptions under one governance boundary. Assigning Azure Policy and role-based access control at the management-group level automatically inherits down to every subscription and resource group in that branch, so production can have strict policies such as deny public endpoints while sandbox is allowed more flexibility. This creates a common, maintainable structure for all 30 subscriptions without configuring each one individually.
- ✗
A set of resource locks applied directly to critical resources in each subscription.
Why it's wrong here
A set of resource locks applied directly to critical resources in each subscription is wrong because locks are operational safeguards that prevent deletion or modification of a specific resource, not architectural components that organize subscriptions. Locks apply to one scope only and are inherited only to child resources within that scope, so they never span subscriptions and cannot separate production from sandbox governance. While locking critical systems is good practice, it does not address the need for a common, policy-driven structure across the 30 subscriptions.
When this WOULD be correct
A question where the requirement is to prevent accidental deletion or modification of critical resources (e.g., a production database) across multiple subscriptions, without needing to enforce policies or inherit rules. For example: 'A company wants to ensure that critical resources in all subscriptions cannot be deleted by administrators. Which construct should they use?'
- ✗
A single policy exemption applied at the tenant root.
Why it's wrong here
A single policy exemption applied at the tenant root is wrong because an exemption is not an organizational container; it tells Azure to skip enforcement of a specific policy or initiative on a particular scope. Applying it at the root would remove enforcement for all subscriptions, weakening compliance and doing nothing to separate production from sandbox. Management is about inheritance and hierarchy, whereas exemptions are point-in-time exceptions for compliance and cannot group or govern subscriptions as a common structure.
When this WOULD be correct
This would be correct if the question asked: 'An organization has a policy that must apply to all subscriptions except a few sandbox subscriptions. Which construct should be used to exclude the sandbox subscriptions from the policy?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A management group hierarchy with separate production and sandbox branches.Correct answer▾
Why this is correct
A management group hierarchy with separate production and sandbox branches is the correct approach because management groups are Azure's native containers for organizing multiple subscriptions under one governance boundary. Assigning Azure Policy and role-based access control at the management-group level automatically inherits down to every subscription and resource group in that branch, so production can have strict policies such as deny public endpoints while sandbox is allowed more flexibility. This creates a common, maintainable structure for all 30 subscriptions without configuring each one individually.
✗A separate resource group for each business unit inside every subscription.Wrong answer — click to see why▾
Why this is wrong here
Resource groups organize resources within a single subscription but cannot enforce policies or rules across multiple subscriptions or automatically apply baselines to new subscriptions.
★ When this WOULD be the correct answer
A question asks how to isolate resources for different business units within a single subscription, ensuring each unit's resources are logically separated and can be managed independently without affecting others.
Why candidates choose this
Candidates may confuse resource groups as a governance tool because they are used to group resources for management, but they lack cross-subscription policy enforcement and automatic inheritance capabilities.
✗A set of resource locks applied directly to critical resources in each subscription.Wrong answer — click to see why▾
Why this is wrong here
Resource locks prevent accidental deletion or modification but cannot enforce a common baseline of allowed regions, required tags, or approved SKU rules across multiple subscriptions, nor can they automatically inherit rules to new subscriptions.
★ When this WOULD be the correct answer
A question where the requirement is to prevent accidental deletion or modification of critical resources (e.g., a production database) across multiple subscriptions, without needing to enforce policies or inherit rules. For example: 'A company wants to ensure that critical resources in all subscriptions cannot be deleted by administrators. Which construct should they use?'
Why candidates choose this
Candidates may confuse resource locks with policy enforcement, thinking locks can enforce rules like allowed regions or tags, when locks only provide a delete/change protection mechanism.
✗A single policy exemption applied at the tenant root.Wrong answer — click to see why▾
Why this is wrong here
A single policy exemption at the tenant root would exempt all subscriptions from a policy, not enforce a baseline. The question requires enforcing rules on production subscriptions, not exempting them.
★ When this WOULD be the correct answer
This would be correct if the question asked: 'An organization has a policy that must apply to all subscriptions except a few sandbox subscriptions. Which construct should be used to exclude the sandbox subscriptions from the policy?'
Why candidates choose this
Candidates may think a policy exemption can define separate governance rules, but exemptions only remove policy enforcement; they cannot apply different baselines to different subscription groups.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.