AZ-104 Manage Azure Identities and Governance Practice Question
A policy initiative is assigned at the Corp management group to enforce allowed locations and required tags. A new subscription is added under Corp later. Which two statements are true? Select two.
⚠ Common exam trap
It's easy for candidates to assume new subscriptions or resources are not automatically covered by a management group policy assignment, or they confuse policy enforcement with RBAC changes, leading them to select options B or D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The new subscription is automatically in scope because the assignment is at the management group.
Azure Policy assignments at a management group scope are inherited by all child subscriptions, including new ones added later. When the Corp management group has the initiative assigned, any subscription under Corp automatically falls within the policy's evaluation scope without requiring manual re-assignment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The new subscription is automatically in scope because the assignment is at the management group.
Why this is correct
Because the initiative is assigned to the corp management group, the assignment applies to that management group and all of its descendant scopes (child management groups, subscriptions, resource groups, and resources). When a new subscription is created under corp, it immediately falls within the assignment's scope, so the policy definitions are enforced and evaluated without any extra step. This inheritance is a fundamental characteristic of Azure Policy and is applied continuously as subscriptions are added or moved.
- ✗
The initiative must be copied to every resource group in the new subscription before it takes effect.
Why it's wrong here
Because the assignment is at the corp management group, it is automatically inherited by the new subscription and every resource group inside it; there is no need to copy or recreate the initiative at a lower scope. Azure Policy inheritance means that any resource group or resource in the subscription is already covered by the same assignment. Copying the initiative to each resource group would cause duplicate assignments and is unnecessary, not required.
When this WOULD be correct
If the question stated that the policy initiative was assigned at the subscription scope and a new resource group was added, then the initiative would need to be assigned to that resource group separately to take effect.
- ✓
Existing noncompliant resources appear in Azure Policy compliance, but they are not changed until remediation runs.
Why this is correct
Azure Policy compliance scanning identifies which existing resources in scope do not satisfy the assigned initiative's conditions, but simply identifying them does not change the resource. To bring already-deployed resources into compliance, a separate remediation task must be run—for example, using the deployIfNotExists or modify effect—which requires a managed identity with the necessary permissions. Until that remediation runs, the resource will remain noncompliant in the compliance view even though the policy is actively assigned.
- ✗
The initiative changes RBAC so users lose read access to the subscription.
Why it's wrong here
Azure Policy works through effects such as audit, deny, append, or deployIfNotExists to evaluate and enforce resource configurations; it never modifies Azure RBAC role assignments or permissions. Resource access (read, write, delete) is controlled by role assignments, which are unaffected by Policy. The only way a policy can appear to affect access is indirectly by denying creation of a role assignment or resource, but it does not revoke existing read access for users.
When this WOULD be correct
If the question were about a custom RBAC role definition that includes a deny action for read permissions, and that role is assigned to users at the subscription scope, then users would lose read access. This would be a correct statement in a scenario about RBAC role assignments, not Azure Policy.
- ✗
Compliance results are only visible in Activity Log, not in Azure Policy.
Why it's wrong here
The Azure Portal has a dedicated Policy blade with a Compliance dashboard that lists per-scope compliance, per-definition results, and per-resource status; returning to the Activity Log is unnecessary and misleading. Activity Log records control-plane events (like creating or deleting resources) and does not persist the ongoing policy compliance state. Therefore, asserting that compliance results are only visible in Activity Log is incorrect because Azure Policy's own reporting surfaces are the primary and authoritative view.
When this WOULD be correct
If the question asked: 'Where can you see the history of policy assignment changes or evaluation events?' then Activity Log would be correct, as it logs all administrative actions including policy assignments and evaluations.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓The new subscription is automatically in scope because the assignment is at the management group.Correct answer▾
Why this is correct
Because the initiative is assigned to the corp management group, the assignment applies to that management group and all of its descendant scopes (child management groups, subscriptions, resource groups, and resources). When a new subscription is created under corp, it immediately falls within the assignment's scope, so the policy definitions are enforced and evaluated without any extra step. This inheritance is a fundamental characteristic of Azure Policy and is applied continuously as subscriptions are added or moved.
✗The initiative must be copied to every resource group in the new subscription before it takes effect.Wrong answer — click to see why▾
Why this is wrong here
Policy assignments at the management group scope automatically apply to all child subscriptions and resource groups; there is no need to copy the initiative to each resource group.
★ When this WOULD be the correct answer
If the question stated that the policy initiative was assigned at the subscription scope and a new resource group was added, then the initiative would need to be assigned to that resource group separately to take effect.
Why candidates choose this
Candidates may think that policies must be explicitly assigned to each resource group, confusing the inheritance behavior of management group assignments with subscription-level assignments.
✗The initiative changes RBAC so users lose read access to the subscription.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy initiatives do not modify Azure RBAC permissions. They evaluate and enforce compliance rules but never change role assignments or access rights.
★ When this WOULD be the correct answer
If the question were about a custom RBAC role definition that includes a deny action for read permissions, and that role is assigned to users at the subscription scope, then users would lose read access. This would be a correct statement in a scenario about RBAC role assignments, not Azure Policy.
Why candidates choose this
Candidates may confuse Azure Policy's enforcement mechanisms with RBAC, assuming that policy restrictions also affect user permissions, or they may think that denying resource creation implies denying read access.
✗Compliance results are only visible in Activity Log, not in Azure Policy.Wrong answer — click to see why▾
Why this is wrong here
Compliance results are visible in Azure Policy's Compliance blade, not only in Activity Log. Activity Log records policy events, but the main compliance view is in Azure Policy.
★ When this WOULD be the correct answer
If the question asked: 'Where can you see the history of policy assignment changes or evaluation events?' then Activity Log would be correct, as it logs all administrative actions including policy assignments and evaluations.
Why candidates choose this
Candidates may confuse the role of Activity Log (which records events) with the compliance dashboard, or think that policy compliance is only tracked via logs rather than a dedicated interface.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.