AZ-104 Manage Azure Identities and Governance Practice Question
A platform team must enforce three governance rules across every subscription in a management group: allowed Azure regions, required Environment tags, and approved VM sizes. They want one assignment that groups the rules together and gives a single compliance view. What should they use?
⚠ Common exam trap
Watch out — candidates often confuse Azure Policy (which enforces rules on resource configurations) with RBAC (which controls user permissions) or management locks (which prevent deletion/modification), leading candidates to select a control that addresses a different aspect of governance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An Azure Policy initiative assigned at the management group.
An Azure Policy initiative (also known as a policy set) allows you to group multiple individual policy definitions—such as allowed regions, required tags, and approved VM sizes—into a single assignment. When assigned at the management group scope, the initiative enforces all three rules across every subscription within that group and provides a unified compliance view in the Azure Policy dashboard, meeting the team's requirement for consolidated governance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A single RBAC role assignment at the management group.
Why it's wrong here
Azure RBAC role assignments grant users or service principals specific permissions to manage Azure resources, such as Contributor or Reader. They control who can perform actions, not what the resources must look like or how they are configured. A single RBAC assignment at the management group cannot enforce region, tagging, or VM size constraints, nor does it provide compliance reporting.
When this WOULD be correct
A question asks: 'A team needs to grant the same contributor permissions to all users in a management group. What should they use?' — A single RBAC role assignment at the management group would be correct.
- ✗
A management lock on each subscription.
Why it's wrong here
Management locks, either CanNotDelete or ReadOnly, are designed to protect resources from accidental deletion or modification, operating as a binary safeguard. They lack the expressiveness to define multiple compliance rules like allowed regions, required tags, or permitted VM SKUs across a subscription. Additionally, locks do not generate compliance status or audit results, so they cannot serve as a governance framework for the platform team.
When this WOULD be correct
A management lock would be correct in a scenario where the goal is to prevent accidental deletion or modification of critical subscriptions, such as locking a production subscription to protect against unauthorized changes.
- ✓
An Azure Policy initiative assigned at the management group.
Why this is correct
An initiative is the right tool when several related policies must be managed as one governance package. It lets the team assign the region, tagging, and VM size rules together, inherit them across all subscriptions under the management group, and review compliance in one place. This is simpler to operate than assigning each policy separately to each subscription.
- ✗
A private endpoint for Azure Resource Manager.
Why it's wrong here
A private endpoint for Azure Resource Manager (ARM) is a network security feature that restricts calls to the ARM API to a private IP address, removing public internet exposure. It is applicable only to supported services and focuses on securing the management plane's network path, not on enforcing resource configuration or compliance. Governance rules about region, tagging, and VM sizes are policy decisions, entirely separate from network-level private connectivity.
When this WOULD be correct
A question asks how to restrict Azure Resource Manager access to a specific virtual network to prevent management plane access from the internet. In that scenario, a private endpoint for Azure Resource Manager would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An Azure Policy initiative assigned at the management group.Correct answer▾
Why this is correct
An initiative is the right tool when several related policies must be managed as one governance package. It lets the team assign the region, tagging, and VM size rules together, inherit them across all subscriptions under the management group, and review compliance in one place. This is simpler to operate than assigning each policy separately to each subscription.
✗A single RBAC role assignment at the management group.Wrong answer — click to see why▾
Why this is wrong here
RBAC role assignments control permissions (who can do what), not governance rules like allowed regions or tags. They cannot enforce resource configurations or provide a compliance view for policies.
★ When this WOULD be the correct answer
A question asks: 'A team needs to grant the same contributor permissions to all users in a management group. What should they use?' — A single RBAC role assignment at the management group would be correct.
Why candidates choose this
Candidates may confuse role assignments (permissions) with policy assignments (governance), thinking a single assignment at the management group can enforce rules, but RBAC does not enforce resource properties.
✗A management lock on each subscription.Wrong answer — click to see why▾
Why this is wrong here
A management lock prevents deletion or modification of resources but cannot enforce governance rules like allowed regions, tags, or VM sizes. It does not provide a compliance view or group multiple policies together.
★ When this WOULD be the correct answer
A management lock would be correct in a scenario where the goal is to prevent accidental deletion or modification of critical subscriptions, such as locking a production subscription to protect against unauthorized changes.
Why candidates choose this
Candidates may confuse management locks with policy enforcement, thinking locks can restrict resource configurations, or they may assume locks provide a compliance view similar to policies.
✗A private endpoint for Azure Resource Manager.Wrong answer — click to see why▾
Why this is wrong here
Private endpoints for Azure Resource Manager restrict network access to Azure Resource Manager endpoints, not enforce governance rules like allowed regions, tags, or VM sizes.
★ When this WOULD be the correct answer
A question asks how to restrict Azure Resource Manager access to a specific virtual network to prevent management plane access from the internet. In that scenario, a private endpoint for Azure Resource Manager would be the correct answer.
Why candidates choose this
Candidates may confuse network-level controls (private endpoints) with policy-based governance, thinking that restricting network access can enforce compliance rules.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.