AZ-104 Manage Azure Identities and Governance Practice Question
A platform team must enforce two governance rules across every current and future subscription under a management group: only East US and West US deployments are allowed, and every resource must include an Environment tag. Which three actions should the administrator take? Select three.
⚠ Common exam trap
A common mix-up: candidates confuse RBAC with Azure Policy, mistakenly thinking a Contributor role can enforce compliance rules, when in fact RBAC controls who can act, while Azure Policy controls what is allowed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a policy initiative that groups the governance requirements.
A policy initiative (also known as a policy set) allows you to group multiple individual Azure Policy definitions into a single, reusable governance package. This simplifies assignment and ensures both the allowed locations and required tag policies are enforced together consistently across all subscriptions under the management group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a policy initiative that groups the governance requirements.
Why this is correct
An Azure Policy initiative (policy set definition) is the correct container when multiple policy definitions must be deployed and evaluated together for a common governance goal. Rather than managing each definition as a separate assignment, an initiative holds a curated list of definitions that can be assigned at any scope, preserving a single compliance rollup and a shared parameter set. This avoids the fragmentation and maintenance overhead of tracking independent assignments that can drift out of sync.
- ✓
Assign the initiative at the management group scope.
Why this is correct
Assigning the initiative at the management group scope, rather than at each subscription or resource group, guarantees that the governance requirements inherit to every child subscription—both those that exist today and any added later. Azure Policy applies assignments created at a management group to all nested scopes, so no per-subscription setup is required and new subscriptions are automatically protected. This meets the platform team's need for universal coverage without manual, error-prone reassignment.
- ✓
Include both the allowed locations policy and the required Environment tag policy in the initiative.
Why this is correct
The initiative must contain both the Allowed Locations policy and the required Environment tag policy because these are the two explicit governance rules that the platform team must enforce. When both definitions are referenced in the same initiative definition, they are evaluated together on the same resource and appear in a single compliance view, making it easy to see whether a resource fails either rule. This grouping also ensures that any future changes to the policy set—such as adjusting the permitted regions—are versioned and deployed consistently.
- ✗
Assign the policies separately to each existing subscription only.
Why it's wrong here
Assigning the policies separately to each existing subscription is flawed because it provides no inheritance for new subscriptions—any subscription created after the assignments will be ungoverned until someone remembers to repeat the task. It also creates multiple, independent compliance evaluations, so there is no enterprise-wide policy compliance summary, and updating a policy requires editing every assignment rather than one shared initiative. This approach is both operationally burdensome and leaves the environment vulnerable to drift.
When this WOULD be correct
If the question specified that governance must be applied only to existing subscriptions and not to future ones, and the management group was not involved, then assigning policies individually to each subscription would be appropriate.
- ✗
Use an RBAC Contributor role to enforce region and tag compliance.
Why it's wrong here
RBAC Contributor does not enforce governance of resource configuration; it only grants authorization to create and manage resources. A Contributor can still create resources in any region or omit required tags, because RBAC has no mechanism to inspect or deny a resource based on its properties—Azure Policy is the service designed for that purpose. Policy definitions can explicitly deny non-compliant deployments, and Azure Policy provides compliance reporting that RBAC fundamentally lacks.
When this WOULD be correct
If the question asked for assigning permissions to a team to manage resources in a subscription, then assigning a Contributor role at the subscription scope would be correct. For example, 'You need to grant a team the ability to create and manage resources in a subscription. Which action should you take?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a policy initiative that groups the governance requirements.Correct answer▾
Why this is correct
An Azure Policy initiative (policy set definition) is the correct container when multiple policy definitions must be deployed and evaluated together for a common governance goal. Rather than managing each definition as a separate assignment, an initiative holds a curated list of definitions that can be assigned at any scope, preserving a single compliance rollup and a shared parameter set. This avoids the fragmentation and maintenance overhead of tracking independent assignments that can drift out of sync.
✗Assign the policies separately to each existing subscription only.Wrong answer — click to see why▾
Why this is wrong here
Assigning policies separately to each existing subscription only fails to cover future subscriptions and does not enforce governance at the management group scope, which is required by the question.
★ When this WOULD be the correct answer
If the question specified that governance must be applied only to existing subscriptions and not to future ones, and the management group was not involved, then assigning policies individually to each subscription would be appropriate.
Why candidates choose this
Candidates may think that applying policies directly to subscriptions is sufficient, overlooking the need for automatic enforcement on new subscriptions and the efficiency of management group assignment.
✗Use an RBAC Contributor role to enforce region and tag compliance.Wrong answer — click to see why▾
Why this is wrong here
RBAC roles control access permissions, not governance rules like allowed locations or required tags. To enforce such rules, Azure Policy is required, not RBAC.
★ When this WOULD be the correct answer
If the question asked for assigning permissions to a team to manage resources in a subscription, then assigning a Contributor role at the subscription scope would be correct. For example, 'You need to grant a team the ability to create and manage resources in a subscription. Which action should you take?'
Why candidates choose this
Candidates may confuse RBAC with Azure Policy, thinking that assigning a role can enforce compliance, or they may assume Contributor role includes policy enforcement capabilities.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.