AZ-104 Manage Azure Identities and Governance Practice Question
A policy assignment denies storage accounts unless public network access is disabled. One legacy storage account in a pilot resource group must remain publicly reachable for 60 days while the application team remediates dependencies. Compliance reporting must continue to show the policy as enforced everywhere else. What should the administrator do?
⚠ Common exam trap
Candidates often confuse Azure Policy exemptions with RBAC or locks, thinking they can bypass policy enforcement through access control or resource protection, when in fact only a policy exemption (or exclusion) can selectively skip the policy's effect while maintaining compliance reporting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an Azure Policy exemption for that storage account
An Azure Policy exemption allows the administrator to exclude a specific scope (the legacy storage account) from the policy's effect while still reporting the policy as enforced on all other resources. The exemption can be set with an expiration date (60 days) to automatically remove the exception after the remediation period. This ensures compliance reporting continues to show the policy as active and enforced everywhere except the exempted resource.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the policy assignment and re-create it later
Why it's wrong here
Deleting the policy assignment removes the deny effect from the entire scope, meaning all storage accounts in that scope—not just this one—would be subject to creation despite meeting the 'public network access' condition. This approach is brittle because it eliminates governance for the whole environment and the re-created assignment would start from a fresh evaluation history, losing the exemption context. It also hides the exception from compliance reporting, which is unacceptable for auditability; the correct approach is to exempt only the specific storage account.
When this WOULD be correct
An administrator needs to temporarily remove a policy that is blocking a critical deployment across the entire subscription, and there are no other resources that must remain compliant during the change. Deleting and recreating the policy assignment after the deployment is acceptable.
- ✓
Use an Azure Policy exemption for that storage account
Why this is correct
An Azure Policy exemption is the designed mechanism to exclude a specific resource or resource group from policy evaluation while the policy assignment remains active for all other resources. You can apply an exemption at the storage account's scope, set an expiration date, and classify it as Waiver or Mitigated, which documents the business rationale and keeps the resource visible in compliance reports as an approved exception. This preserves governance for the rest of the environment and maintains auditability.
- ✗
Apply a read-only lock to the storage account
Why it's wrong here
A read-only lock (Microsoft.Authorization/locks) prevents anyone from performing create, update, or delete operations on the storage account through the management plane, but it does not affect Azure Policy evaluation. Azure Policy inspects resource properties and configurations against the denylist; locks are not part of the resource's configuration that the policy evaluates. Even with a read-only lock, the storage account remains non-compliant, and the lock does not provide any official exemption record in the compliance dashboard.
When this WOULD be correct
A read-only lock would be correct if the question asked how to prevent accidental deletion or modification of a critical resource, such as a storage account containing immutable audit logs, while still allowing read access.
- ✗
Assign a custom RBAC role to the application team
Why it's wrong here
Custom RBAC roles define allowable actions for users or groups, but Azure Policy is an independent, resource-focused governance layer that evaluates resource properties, not the identity performing an operation. Even if the application team has Owner or Contributor rights, the policy assignment with deny effect will still block creation of publicly accessible storage accounts and flag existing ones as non-compliant. RBAC cannot alter or 'waive' policy compliance status; only an exemption (or a change to the policy/assignment) can do that.
When this WOULD be correct
An administrator needs to grant the application team specific permissions to manage storage accounts without giving them full contributor access, while still enforcing policies. Assigning a custom RBAC role with only required actions would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use an Azure Policy exemption for that storage accountCorrect answer▾
Why this is correct
An Azure Policy exemption is the designed mechanism to exclude a specific resource or resource group from policy evaluation while the policy assignment remains active for all other resources. You can apply an exemption at the storage account's scope, set an expiration date, and classify it as Waiver or Mitigated, which documents the business rationale and keeps the resource visible in compliance reports as an approved exception. This preserves governance for the rest of the environment and maintains auditability.
✗Delete the policy assignment and re-create it laterWrong answer — click to see why▾
Why this is wrong here
Deleting the policy assignment would remove enforcement from all resources, not just the legacy storage account, violating the requirement that compliance reporting must continue to show the policy as enforced everywhere else.
★ When this WOULD be the correct answer
An administrator needs to temporarily remove a policy that is blocking a critical deployment across the entire subscription, and there are no other resources that must remain compliant during the change. Deleting and recreating the policy assignment after the deployment is acceptable.
Why candidates choose this
Candidates may think that removing the policy assignment is a straightforward way to allow the exception, without considering the impact on other resources and the need for continued compliance reporting.
✗Apply a read-only lock to the storage accountWrong answer — click to see why▾
Why this is wrong here
A read-only lock prevents modifications to the storage account but does not exempt it from the policy that denies public network access; the policy would still block public access, making the account unreachable.
★ When this WOULD be the correct answer
A read-only lock would be correct if the question asked how to prevent accidental deletion or modification of a critical resource, such as a storage account containing immutable audit logs, while still allowing read access.
Why candidates choose this
Candidates may confuse locks with policy exemptions, thinking a lock can override policy enforcement, or they may believe that preventing changes to the account's configuration will somehow bypass the policy.
✗Assign a custom RBAC role to the application teamWrong answer — click to see why▾
Why this is wrong here
Assigning a custom RBAC role to the application team does not exempt the storage account from the policy; the policy still denies public network access, and RBAC roles control permissions, not policy compliance.
★ When this WOULD be the correct answer
An administrator needs to grant the application team specific permissions to manage storage accounts without giving them full contributor access, while still enforcing policies. Assigning a custom RBAC role with only required actions would be correct.
Why candidates choose this
Candidates may confuse RBAC with policy exemptions, thinking that granting permissions can override policy enforcement, or they may believe that the application team needs elevated roles to remediate dependencies.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Policy assignment
Policy assignment is the process of attaching a set of rules or permissions to a specific resource, user, or group so that those rules are enforced in a cloud or IT environment.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.