AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Remove the policy assignment from the management group until the migration is finished.

  Why it's wrong here

  Removing the policy assignment at the management group would disable the deny effect for every subscription and resource within that group, not just the storage account in question. This creates a governance gap: while the migration proceeds, any new resource in any subscription could be created without the intended compliance controls, and the temporary removal also invites drift and requires manual re-assignment later. A far more targeted approach is to create an exemption for the single storage account with an expiration date, which preserves the policy for all other resources and ensures the exception is automatically retired after the migration.

  When this WOULD be correct

  If the question stated that the policy was incorrectly assigned and should be removed entirely, or if the requirement was to temporarily allow all resources under the management group to bypass the policy without exceptions, then removing the assignment would be correct.

• ✓

  Create a policy exemption for the specific storage account with an expiration date.

  Why this is correct

  A policy exemption allows one approved resource to temporarily bypass the deny effect while preserving the policy for everything else. Adding an expiration date ensures the exception is temporary and supports compliance tracking during the migration period.

• ✗

  Apply a CanNotDelete lock to the storage account.

  Why it's wrong here

  A CanNotDelete lock protects a resource from deletion, but it does not prevent Azure Policy from evaluating a deny effect during create or update operations. The deny effect is enforced by the resource provider when the storage account is deployed or configured, and a lock simply adds an Azure Resource Manager-level protection that blocks DELETE calls; it does not exempt the resource from compliance checks. In this scenario, the lock cannot be applied before the resource exists, and even if applied to an existing resource, it would not allow a denied network configuration to be created or changed.

• ✗

  Assign a Contributor role to the migration team on the storage account.

  Why it's wrong here

  The Contributor role grants the migration team full management rights over the storage account's resources, including the ability to change its network settings. However, Azure Policy is a governance layer that is evaluated independently of role-based access control: a policy with a deny effect will block an operation even if the caller has Contributor, Owner, or any other high-privilege role. Assigning Contributor therefore does nothing to bypass the policy's denial; the only way to allow the specific configuration is to create a policy exemption for that resource, which explicitly excludes it from the policy evaluation.

  When this WOULD be correct

  This option would be correct if the question asked: 'The migration team needs to manage resources in the storage account (e.g., read/write blobs) but currently has no access. What should the administrator configure?' In that case, assigning the Contributor role would grant the necessary permissions.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question