AZ-104 Manage Azure Identities and Governance Practice Question
A compliance team wants to identify all resources in a department that are missing an Environment tag, but they do not want to stop users from creating or changing resources. Which two choices should the administrator make? Select two.
⚠ Common exam trap
Many candidates confuse the Audit effect with the Deny effect, thinking they need to block non-compliant resources to identify them, or they mistakenly believe granting Reader access is sufficient for automated tag discovery, when in fact Azure Policy is the correct tool for compliance evaluation without enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an Azure Policy assignment with the Audit effect.
The Audit effect in Azure Policy allows the compliance team to identify resources missing an Environment tag without blocking resource creation or modification. This effect logs non-compliant resources to the activity log, enabling visibility without enforcement. Option B is correct because assigning the policy at the management group scope ensures it applies to all subscriptions within that department, covering all resources under a single governance boundary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use an Azure Policy assignment with the Audit effect.
Why this is correct
The Audit effect evaluates resources for compliance without blocking the request. Each non-compliant resource (e.g., missing a required tag) appears in the policy compliance report with its status, while the deployment or update proceeds normally. This makes Audit the ideal choice for a compliance team that only needs to identify gaps and report them, not enforce controls yet.
- ✓
Assign the policy at the management group scope that contains the department subscriptions.
Why this is correct
Assigning the policy at the management group scope applies it to every subscription nested beneath it, including newly created ones, without needing a separate assignment per subscription. The policy engine evaluates resources across all these subscriptions and aggregates compliance results at the management group level. This centralizes governance and reduces administrative overhead while ensuring broad, consistent reporting coverage for the department's entire footprint.
- ✗
Use the Deny effect.
Why it's wrong here
The Deny effect blocks the creation or update of any resource that violates the policy, which is exactly the opposite of the stated goal of merely identifying non-compliant resources. With Deny, users would be prevented from creating resources without the required tag, causing friction and potentially halting legitimate work. Compliance teams need visibility first; enforcement can come later, but Deny forces enforcement immediately and is therefore inappropriate for a reporting-only request.
When this WOULD be correct
If the compliance team needed to enforce the presence of the Environment tag and block any resources that lack it, then using an Azure Policy with the Deny effect would be correct.
- ✗
Grant Reader on the subscription to the compliance team.
Why it's wrong here
Granting Reader on the subscription gives the compliance team the ability to list and view resource properties, but it does not invoke Azure Policy evaluation or produce compliance results. The tag-missing status is a policy evaluation outcome stored in the policy compliance report, not a visible attribute of the resource itself. Without policy assignments and evaluation, Reader access alone cannot tell which resources are non-compliant—it merely allows viewing the raw resources as they exist.
When this WOULD be correct
In a scenario where the compliance team needs to review resource configurations without making changes, and the goal is simply to grant them visibility into existing resources, granting Reader role at the subscription level would be correct.
- ✗
Apply a ReadOnly lock to all resource groups.
Why it's wrong here
ReadOnly locks are a resource management safeguard that prevents accidental modification or deletion of resources and resource groups, but they do not inspect or analyze tags. They would block legitimate rename, update, and delete operations for everyone, which conflicts with the requirement that users keep creating and changing resources. Locks are not a compliance assessment mechanism; they simply restrict changes at the ARM control plane and offer no reporting on policy adherence.
When this WOULD be correct
If the question required preventing accidental deletion or modification of critical resources while still allowing read access, applying a ReadOnly lock to resource groups would be correct. For example, 'You need to ensure that no one can delete or modify resources in a production resource group, but the operations team must still be able to view them.'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use an Azure Policy assignment with the Audit effect.Correct answer▾
Why this is correct
The Audit effect evaluates resources for compliance without blocking the request. Each non-compliant resource (e.g., missing a required tag) appears in the policy compliance report with its status, while the deployment or update proceeds normally. This makes Audit the ideal choice for a compliance team that only needs to identify gaps and report them, not enforce controls yet.
✗Use the Deny effect.Wrong answer — click to see why▾
Why this is wrong here
The Deny effect prevents resource creation or modification if the tag is missing, which contradicts the requirement to not stop users from creating or changing resources.
★ When this WOULD be the correct answer
If the compliance team needed to enforce the presence of the Environment tag and block any resources that lack it, then using an Azure Policy with the Deny effect would be correct.
Why candidates choose this
Candidates may think that enforcing compliance requires blocking non-compliant actions, but the question explicitly states they do not want to stop users, so Deny is too restrictive.
✗Grant Reader on the subscription to the compliance team.Wrong answer — click to see why▾
Why this is wrong here
Granting Reader permission to the compliance team allows them to view resources but does not identify missing tags or enforce compliance; it only provides read access, not the ability to audit or report on tag requirements.
★ When this WOULD be the correct answer
In a scenario where the compliance team needs to review resource configurations without making changes, and the goal is simply to grant them visibility into existing resources, granting Reader role at the subscription level would be correct.
Why candidates choose this
Candidates may think that giving the compliance team read access is sufficient for them to manually check for missing tags, overlooking that Azure Policy provides automated compliance assessment and reporting.
✗Apply a ReadOnly lock to all resource groups.Wrong answer — click to see why▾
Why this is wrong here
A ReadOnly lock prevents any changes to resources, but the compliance team only needs to identify missing tags, not block modifications. The question explicitly states they do not want to stop users from creating or changing resources.
★ When this WOULD be the correct answer
If the question required preventing accidental deletion or modification of critical resources while still allowing read access, applying a ReadOnly lock to resource groups would be correct. For example, 'You need to ensure that no one can delete or modify resources in a production resource group, but the operations team must still be able to view them.'
Why candidates choose this
Candidates may confuse 'identifying resources' with 'preventing changes' and think a lock is a safe, non-intrusive way to enforce compliance without understanding that locks block all write operations.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.