AZ-104 Manage Azure Identities and Governance Practice Question
A policy at the management group denies storage accounts that allow public network access. One legacy storage account in RG-Legacy must stay public for 30 days while a migration runs, and the team does not want to change the policy for everyone else. What should the administrator create?
⚠ Common exam trap
Watch out — candidates often confuse policy exemptions with resource locks or RBAC, thinking that locking the resource or assigning permissions can bypass policy enforcement, but only a policy exemption can create a targeted exception without altering the policy definition.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A policy exemption for that storage account
A policy exemption allows specific resources to be excluded from the effect of a policy initiative without modifying the original policy definition. In this scenario, the management group policy denies storage accounts with public network access, but the legacy account needs to remain public temporarily. By creating a policy exemption (with 'exempt' category) for that specific storage account, the administrator can bypass the deny effect for 30 days while the policy continues to apply to all other resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A resource lock on the storage account
Why it's wrong here
A resource lock, such as CanNotDelete or ReadOnly, prevents users from modifying or deleting the storage account, but it is evaluated independently of Azure Policy. In fact, a lock would make the migration harder because the storage account cannot be updated, while the deny policy still enforces a denial on configuration changes. Locks are a separate governance control for accidental deletion, not an exception mechanism, and they cannot supersede a policy deny effect.
When this WOULD be correct
A resource lock would be correct if the question asked for a mechanism to prevent accidental deletion or modification of a critical resource, such as a storage account that must remain unchanged during a migration.
- ✓
A policy exemption for that storage account
Why this is correct
A policy exemption is designed for temporary or justified exceptions to an assignment without weakening the control for all other resources. It lets the legacy storage account remain out of compliance for the approved period while the deny policy continues to apply everywhere else under the management group.
- ✗
A second policy assignment with higher priority
Why it's wrong here
Azure Policy assignments do not have a 'priority' property or ordering that can supersede a deny effect. If you add a second policy assignment for any definition, the deny still applies because policy evaluation is additive, and the presence of one deny will cause non-compliant writes to be rejected. The only supported way to exempt a specific storage account is to create a policy exemption for it, not to add an alternative assignment with higher precedence.
When this WOULD be correct
If the question involved multiple policy assignments with conflicting effects (e.g., one allows, one denies) and the administrator needed to ensure a specific assignment takes precedence, then creating a second assignment with a higher priority would be correct.
- ✗
A custom RBAC role for the migration team
Why it's wrong here
A custom RBAC role grants specific management permissions to the migration team, but Azure Policy evaluation is orthogonal to identity. When a request affects a storage account, Azure Resource Manager checks policy deny effects before RBAC authorization, so the deny blocks the write no matter what role the team holds. A custom role only controls who may manage resources; it provides no mechanism for excluding a storage account from an existing policy assignment.
When this WOULD be correct
If the question asked for a way to grant the migration team specific permissions to manage storage accounts without giving them full contributor access, a custom RBAC role would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A policy exemption for that storage accountCorrect answer▾
Why this is correct
A policy exemption is designed for temporary or justified exceptions to an assignment without weakening the control for all other resources. It lets the legacy storage account remain out of compliance for the approved period while the deny policy continues to apply everywhere else under the management group.
✗A resource lock on the storage accountWrong answer — click to see why▾
Why this is wrong here
A resource lock prevents deletion or modification of the storage account, but it does not override the policy that denies public network access. The lock cannot exempt the account from the policy effect.
★ When this WOULD be the correct answer
A resource lock would be correct if the question asked for a mechanism to prevent accidental deletion or modification of a critical resource, such as a storage account that must remain unchanged during a migration.
Why candidates choose this
Candidates may confuse resource locks with policy exemptions, thinking that locking the resource can protect it from policy enforcement, but locks only affect management operations, not policy evaluation.
✗A second policy assignment with higher priorityWrong answer — click to see why▾
Why this is wrong here
Policy assignments with higher priority do not override existing policy definitions; Azure Policy uses 'deny' effects that cannot be bypassed by priority. A second assignment would still enforce the deny effect on the storage account.
★ When this WOULD be the correct answer
If the question involved multiple policy assignments with conflicting effects (e.g., one allows, one denies) and the administrator needed to ensure a specific assignment takes precedence, then creating a second assignment with a higher priority would be correct.
Why candidates choose this
Candidates may think that policy assignments have a priority order similar to RBAC roles, where a higher-priority assignment can override a lower one, but Azure Policy does not support this for deny effects.
✗A custom RBAC role for the migration teamWrong answer — click to see why▾
Why this is wrong here
A custom RBAC role controls permissions for users, not policy enforcement. It cannot override a deny policy at the management group scope, so it would not allow the storage account to remain public.
★ When this WOULD be the correct answer
If the question asked for a way to grant the migration team specific permissions to manage storage accounts without giving them full contributor access, a custom RBAC role would be correct.
Why candidates choose this
Candidates may confuse RBAC roles with policy exemptions, thinking that assigning a custom role to the migration team could bypass the policy, but RBAC does not affect Azure Policy evaluation.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Policy definition
A policy definition is a formal rule or set of rules that specifies allowed or denied actions on resources within an IT environment, often used for governance, compliance, and security control.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.