AZ-104 Manage Azure Identities and Governance Practice Question
A team can already deploy virtual machines, but they want to prevent users from creating VMs unless the deployment includes an approved tag. They also want to see which existing resources do not meet the rule. What should the administrator use?
⚠ Common exam trap
It's easy for candidates to confuse Azure Policy (which enforces rules on resource properties like tags) with RBAC (which controls who can perform actions), leading candidates to mistakenly choose a custom role instead of the policy-based solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An Azure Policy assignment with a deny or audit effect for the tag requirement.
Azure Policy with a 'deny' effect prevents creation of VMs that lack the required tag, while the 'audit' effect identifies non-compliant existing resources without blocking them. This directly addresses both requirements: enforcing the tag on new deployments and discovering which existing resources violate the rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A custom RBAC role that removes the create action for virtual machines.
Why it's wrong here
A custom RBAC role that removes the create action for virtual machines (Microsoft.Compute/virtualMachines/write) is an identity-based control: it determines who can perform the action, not whether the resulting resource satisfies a required tag. If assigned, it would block all VM creation by those users, even compliant deployments, and it provides no compliance reporting or auditing of non-compliant resources. Additionally, RBAC cannot evaluate resource properties like tags, so it fails to enforce the specific governance requirement of tagging at deployment time.
When this WOULD be correct
This would be correct if the goal was to completely prevent a specific user or group from creating any VMs, regardless of tags, such as enforcing a separation of duties where only a dedicated team can provision VMs.
- ✓
An Azure Policy assignment with a deny or audit effect for the tag requirement.
Why this is correct
Azure Policy is the correct control because the requirement is about resource compliance, not user authorization. A policy can deny deployments that do not include the approved tag and can also audit existing resources to show which ones are noncompliant. That separates governance enforcement from RBAC, which only decides who is allowed to perform actions in Azure.
- ✗
A resource lock on the resource group.
Why it's wrong here
A resource lock prevents accidental deletion or modification of a resource group or its resources at the management plane level, typically using CanNotDelete or ReadOnly. It does not inspect the resource payload for tags or evaluate any compliance rules. A lock would simply block all deletion or mutation operations, not specifically those missing a required tag, and it cannot enforce the presence of a tag during initial creation because locks are applied only to existing resources. This is a protective measure, not a governance validation tool.
When this WOULD be correct
An administrator needs to prevent accidental deletion of a critical resource group containing production VMs. A resource lock (e.g., CanNotDelete) would be the correct solution.
- ✗
An Entra ID dynamic group for the VM creators.
Why it's wrong here
Entra ID dynamic groups automatically manage user membership based on properties like department or location, but they are unrelated to resource configuration or tagging. Group membership affects token claims and conditional access, not how the VM is deployed in Azure Resource Manager. A dynamic group could not intercept an ARM deployment request to validate a required cost-center tag, nor could it deny the deployment based on missing metadata. Therefore, it has zero effect on ensuring the tag requirement is met.
When this WOULD be correct
An administrator needs to automatically grant or revoke access to Azure resources based on user attributes (e.g., department or location). In that case, an Entra ID dynamic group would be used to assign RBAC roles dynamically.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An Azure Policy assignment with a deny or audit effect for the tag requirement.Correct answer▾
Why this is correct
Azure Policy is the correct control because the requirement is about resource compliance, not user authorization. A policy can deny deployments that do not include the approved tag and can also audit existing resources to show which ones are noncompliant. That separates governance enforcement from RBAC, which only decides who is allowed to perform actions in Azure.
✗A custom RBAC role that removes the create action for virtual machines.Wrong answer — click to see why▾
Why this is wrong here
A custom RBAC role that removes the create action for VMs would prevent all VM creation, not enforce a tag requirement. It cannot audit existing resources for compliance, only block future actions.
★ When this WOULD be the correct answer
This would be correct if the goal was to completely prevent a specific user or group from creating any VMs, regardless of tags, such as enforcing a separation of duties where only a dedicated team can provision VMs.
Why candidates choose this
Candidates may confuse RBAC with Azure Policy, thinking that restricting the create action can enforce tagging, but RBAC controls permissions, not resource configuration compliance.
✗A resource lock on the resource group.Wrong answer — click to see why▾
Why this is wrong here
A resource lock prevents deletion or modification of resources but does not enforce tagging requirements during deployment or audit existing resources for compliance.
★ When this WOULD be the correct answer
An administrator needs to prevent accidental deletion of a critical resource group containing production VMs. A resource lock (e.g., CanNotDelete) would be the correct solution.
Why candidates choose this
Candidates may confuse resource locks with policy enforcement, thinking a lock can block creation of VMs without tags, but locks only protect existing resources from changes or deletion.
✗An Entra ID dynamic group for the VM creators.Wrong answer — click to see why▾
Why this is wrong here
Entra ID dynamic groups manage user membership based on attributes, not resource compliance. They cannot enforce tagging rules on VM deployments or audit existing resources for missing tags.
★ When this WOULD be the correct answer
An administrator needs to automatically grant or revoke access to Azure resources based on user attributes (e.g., department or location). In that case, an Entra ID dynamic group would be used to assign RBAC roles dynamically.
Why candidates choose this
Candidates may confuse identity-based governance (Entra ID groups) with resource governance (Azure Policy), thinking that controlling who can create VMs is equivalent to enforcing tagging rules.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.