Manage Azure Identities and Governance →hardMultiple SelectObjective-mapped

AZ-104 Manage Azure Identities and Governance Practice Question

A Modify policy adds CostCenter=042 to resources in RG-Finance. New resources are tagged correctly, but existing virtual machines remain untagged. What three requirements must be met for the assignment to update the existing resources? Select three.

⚠ Common exam trap

Many exam-takers assume the Modify effect automatically updates existing resources, but it only applies to new resources; a remediation task is mandatory for existing resources, and the managed identity must have appropriate permissions (e.g., Tag Contributor) at the scope.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a remediation task for the policy assignment.

A remediation task is required to apply a Modify effect policy to existing non-compliant resources. The Modify effect only tags new resources automatically; existing resources remain untagged until a remediation task is triggered, which uses the policy's managed identity to update the resource tags.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Create a remediation task for the policy assignment.
Why this is correct
A Modify policy assignment only makes the effect available to the Azure Policy engine; it does not automatically update already-provisioned resources. Existing virtual machines in the finance resource group remain non-compliant until you trigger a remediation task, which asynchronously invokes the resource provider to write the costcenter=042 tag. You can run the task on demand or schedule it, and it will report the number of resources successfully remediated versus those that failed.
✓
Ensure the policy assignment has a managed identity.
Why this is correct
The Modify effect must execute an ARM (Azure Resource Manager) write operation against the target resources, so the policy assignment requires a managed identity to authenticate those calls. Without an assigned identity, the policy can evaluate and report non-compliance but has no principal under which to issue a PATCH request to apply the tag. You enable this identity when creating the assignment, choosing either a system-assigned or user-assigned managed identity.
✓
Grant that identity permission to update the target resources or tags at the assigned scope.
Why this is correct
Even with a valid managed identity, the Azure Policy runtime will receive an authorization failure unless that identity has RBAC permissions on the scope—at minimum a role such as Tag Contributor (which grants Microsoft.Resources/tags/write) or Contributor. Apply the role to the identity on the resource group, not to individual VMs, so the remediation task can modify every resource within the assigned scope. A common error is configuring the identity but forgetting to assign the role, which makes remediation tasks fail with a 403 status.
✗
Recreate the virtual machines before the policy can evaluate them.
Why it's wrong here
There is no need to recreate or redeploy the virtual machines because Azure Policy's Modify effect, combined with a remediation task, is designed to update existing resources in place without downtime. Recreating a VM may also fail to add the desired tag unless your deployment template explicitly includes the tag, and the new VM would still be evaluated from scratch. Policy evaluation is continuous and covers all resources, regardless of whether they were created before or after the assignment, so recreation is an unnecessary and ineffective workaround.
When this WOULD be correct
In a scenario where a policy uses the DeployIfNotExists effect to install an agent on VMs, and the VMs must be redeployed to trigger the agent installation because the policy cannot modify existing VMs without remediation, then recreating VMs might be required if remediation is not configured.
✗
Change the effect from Modify to Audit to trigger the tag operation.
Why it's wrong here
Changing the effect to Audit is logically incorrect because Audit does not perform any write operation—it only compares the resource's current tags against the policy rule and generates a compliance result. If you switch from Modify to Audit, Azure Policy will report the resources as non-compliant but will never attempt to add the costcenter tag. This would solve the original problem (applying the tag) by removing the mechanism that could apply it, making the situation worse.
When this WOULD be correct
In a scenario where a policy uses the 'Audit' effect to detect non-compliant resources and you need to trigger a separate remediation action (e.g., via a runbook or manual process), changing to Audit would be correct to enable compliance evaluation without automatic modification.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

✓Create a remediation task for the policy assignment.Correct answer▾

Why this is correct

A Modify policy assignment only makes the effect available to the Azure Policy engine; it does not automatically update already-provisioned resources. Existing virtual machines in the finance resource group remain non-compliant until you trigger a remediation task, which asynchronously invokes the resource provider to write the costcenter=042 tag. You can run the task on demand or schedule it, and it will report the number of resources successfully remediated versus those that failed.

✗Recreate the virtual machines before the policy can evaluate them.Wrong answer — click to see why▾

Why this is wrong here

Azure Policy evaluates existing resources automatically; recreating VMs is unnecessary because the Modify effect with a remediation task can update tags on existing resources without redeployment.

★ When this WOULD be the correct answer

In a scenario where a policy uses the DeployIfNotExists effect to install an agent on VMs, and the VMs must be redeployed to trigger the agent installation because the policy cannot modify existing VMs without remediation, then recreating VMs might be required if remediation is not configured.

Why candidates choose this

Candidates may think that policy only applies to new resources and that existing resources need to be recreated to comply, misunderstanding that Azure Policy can evaluate and remediate existing resources through remediation tasks.

✗Change the effect from Modify to Audit to trigger the tag operation.Wrong answer — click to see why▾

Why this is wrong here

The Modify effect already triggers the tag operation; changing to Audit would only evaluate compliance without applying tags, failing to update existing resources.

★ When this WOULD be the correct answer

In a scenario where a policy uses the 'Audit' effect to detect non-compliant resources and you need to trigger a separate remediation action (e.g., via a runbook or manual process), changing to Audit would be correct to enable compliance evaluation without automatic modification.

Why candidates choose this

Candidates may confuse the purpose of policy effects, thinking Audit is needed to 'activate' the policy or that Modify requires an explicit trigger, not understanding that Modify inherently applies changes.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

AZ-104 Manage Azure Identities and Governance Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question