AZ-104 Manage Azure Identities and Governance Practice Question
A compliance team wants to bundle three policy definitions—allowed locations, required cost center tags, and approved VM sizes—so they can assign them together to a management group and review compliance in one place. Later they want to exempt one pilot subscription from the entire set for 60 days. What should they use?
⚠ Common exam trap
Watch out — candidates often confuse policy exemptions with resource locks or RBAC roles, thinking that locking a subscription or assigning permissions can bypass policy evaluation, when in fact only a policy exemption (or an explicit deny assignment override) can exclude a scope from compliance enforcement for a defined period.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A policy initiative at the management group scope.
A policy initiative (also called a policy set) allows you to group multiple policy definitions into a single, reusable bundle. By assigning the initiative at the management group scope, all three policies apply together to every subscription under that group. When the pilot subscription needs an exemption, you can create an exemption resource on that subscription for the entire initiative, specifying a 60-day expiration, which temporarily excludes it from all bundled policies while keeping compliance reporting unified.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A policy initiative at the management group scope.
Why this is correct
A policy initiative is specifically designed to group multiple policy definitions into a single assignable unit at any scope, including a management group. By assigning the initiative at the management group scope, all descendant subscriptions and resource groups automatically inherit the bundled policies, and Azure Policy aggregates compliance results across every definition in the initiative. This gives the compliance team one consolidated view of whether all three definitions are being met, enabling centralized enforcement and reporting without needing to assign each policy definition separately.
- ✗
A custom RBAC role with resource permissions for policy management.
Why it's wrong here
A custom RBAC role with permissions for policy management controls which administrators can create, modify, or assign policies, but it does not itself contain policy definitions or aggregate compliance results. RBAC roles define authorization boundaries for managing Azure resources, not the rules that govern resource configuration. While such a role might help the compliance team administer policies, it cannot serve as a grouping mechanism for the three specific policy definitions nor provide the compliance assessment the team needs.
When this WOULD be correct
A question asks: 'You need to grant a junior administrator the ability to create and assign policy definitions but not modify other Azure resources. What should you create?' In that case, a custom RBAC role with the Microsoft.Authorization/policyAssignments/write permission would be correct.
- ✗
A resource lock on the pilot subscription.
Why it's wrong here
A resource lock is a safeguard that prevents accidental deletion or modification of resources within a subscription, but it has no awareness of policy definitions or compliance. Locks do not evaluate the configuration of resources, bundle rules into a single governance unit, or produce compliance reports. Using a lock would protect the pilot subscription from disruptive changes but would not satisfy the requirement to group three policy definitions for enforcement and tracking.
When this WOULD be correct
A resource lock would be correct if the question asked: 'A team wants to prevent accidental deletion of a critical subscription for 60 days. What should they use?'
- ✗
A separate management group for each of the three policy definitions.
Why it's wrong here
Creating a separate management group for each policy definition would fragment governance rather than consolidate it, and management groups are organizational containers, not policy containers. Each definition would still need to be assigned individually to whatever scopes contain the pilot subscription, and you would lose the ability to enforce and report on all three as a single unit. This approach increases administrative overhead and complicates inheritance, making it harder to manage compliance compared to a single initiative that bundles the definitions together.
When this WOULD be correct
A question where an organization needs to isolate different environments (e.g., production, development, testing) with distinct policy requirements, and each environment requires its own set of policies assigned to a dedicated management group.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A policy initiative at the management group scope.Correct answer▾
Why this is correct
A policy initiative is specifically designed to group multiple policy definitions into a single assignable unit at any scope, including a management group. By assigning the initiative at the management group scope, all descendant subscriptions and resource groups automatically inherit the bundled policies, and Azure Policy aggregates compliance results across every definition in the initiative. This gives the compliance team one consolidated view of whether all three definitions are being met, enabling centralized enforcement and reporting without needing to assign each policy definition separately.
✗A custom RBAC role with resource permissions for policy management.Wrong answer — click to see why▾
Why this is wrong here
A custom RBAC role with resource permissions for policy management does not bundle policy definitions or allow assigning them together to a management group; RBAC controls access to resources, not policy assignment.
★ When this WOULD be the correct answer
A question asks: 'You need to grant a junior administrator the ability to create and assign policy definitions but not modify other Azure resources. What should you create?' In that case, a custom RBAC role with the Microsoft.Authorization/policyAssignments/write permission would be correct.
Why candidates choose this
Candidates may think that managing policies requires special permissions, so they confuse the tool for defining and assigning policies (initiative) with the tool for granting permissions to manage policies (RBAC role).
✗A resource lock on the pilot subscription.Wrong answer — click to see why▾
Why this is wrong here
A resource lock prevents deletion or modification of a subscription, but it does not bundle or assign policy definitions, nor does it allow exempting a subscription from policies for a specific duration.
★ When this WOULD be the correct answer
A resource lock would be correct if the question asked: 'A team wants to prevent accidental deletion of a critical subscription for 60 days. What should they use?'
Why candidates choose this
Candidates may confuse resource locks with policy exemptions, thinking a lock can temporarily disable policy enforcement, or they may misinterpret 'exempt' as 'protect from changes'.
✗A separate management group for each of the three policy definitions.Wrong answer — click to see why▾
Why this is wrong here
Creating separate management groups for each policy definition does not bundle them into a single assignable unit; the compliance team needs to assign all three together, which requires an initiative (policy set), not separate management groups.
★ When this WOULD be the correct answer
A question where an organization needs to isolate different environments (e.g., production, development, testing) with distinct policy requirements, and each environment requires its own set of policies assigned to a dedicated management group.
Why candidates choose this
Candidates may think that grouping policies requires creating separate management groups for each policy, confusing organizational structure with policy grouping mechanisms.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.