AZ-104 Manage Azure Identities and Governance Practice Question
A team wants every resource in a subscription to include a Department tag. New resources that do not have the tag should be blocked from being created. Which Azure Policy effect should you use?
⚠ Common exam trap
Test-takers frequently confuse Append with Deny, thinking Append will automatically add the tag and thus 'block' the resource, but Append only modifies the request and does not prevent creation if the tag cannot be applied, whereas Deny actively rejects the request.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny
The Deny effect is correct because it actively blocks any resource creation or update request that does not include the required Department tag, enforcing compliance at the time of the operation. Unlike Audit, which only logs non-compliant resources, Deny prevents the non-compliant resource from being provisioned, directly meeting the requirement to block new resources without the tag.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Audit
Why it's wrong here
The Audit effect evaluates resources for compliance and writes an entry to the Azure Activity Log when a resource is noncompliant, but it does not prevent the resource from being created or updated. A resource missing the required tag is still deployed successfully, and the policy only reports the noncompliance after the fact. Because the team needs every resource to have the tag, Audit cannot block the occurrence and therefore fails the requirement.
When this WOULD be correct
Use Audit when you need to identify existing resources missing the Department tag without blocking creation, e.g., to generate compliance reports before enforcing a policy.
- ✓
Deny
Why this is correct
The Deny effect blocks any resource deployment or update that violates the policy rule. When a resource is submitted without the required tag, Azure Policy evaluates it in the request pipeline and returns an HTTP 403 Conflict before the resource is provisioned, so the noncompliant resource never exists. This is the only effect that enforces the mandatory tag at creation time and prevents the deployment from succeeding, making it the correct choice for the team's requirement.
- ✗
Append
Why it's wrong here
The Append effect adds or modifies properties on a resource during deployment by extending the resource with a fixed, pre-configured value. It does not block the deployment if the tag is missing; instead it injects the tag with the exact value defined in the policy rule, which is inflexible because all resources will receive the same value rather than a user-specified one. Furthermore, Append cannot be applied to all resource types or properties, and it does not suppress the creation of a resource that lacks the required tag, so it does not meet the 'block missing tags' requirement.
When this WOULD be correct
Use Append when you want to automatically add a required tag (e.g., Department) to resources that are created without it, without blocking the creation. For example, a policy that ensures all new resources get a 'CostCenter' tag by appending it if missing.
- ✗
Disabled
Why it's wrong here
The Disabled effect turns off the policy enforcement completely; Azure Policy will not evaluate the rule or take any action. This means resources can be deployed without the required tag, and no compliance record or enforcement event is generated. Using Disabled would have no effect on the subscription and would not help the team ensure every resource includes the mandatory tag.
When this WOULD be correct
Use 'Disabled' when you want to temporarily turn off a policy without deleting it, such as during maintenance or testing, while retaining the policy definition for future use.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓DenyCorrect answer▾
Why this is correct
The Deny effect blocks any resource deployment or update that violates the policy rule. When a resource is submitted without the required tag, Azure Policy evaluates it in the request pipeline and returns an HTTP 403 Conflict before the resource is provisioned, so the noncompliant resource never exists. This is the only effect that enforces the mandatory tag at creation time and prevents the deployment from succeeding, making it the correct choice for the team's requirement.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs non-compliant resources but does not block creation. The question requires blocking creation of new resources without the tag, which only Deny can enforce.
★ When this WOULD be the correct answer
Use Audit when you need to identify existing resources missing the Department tag without blocking creation, e.g., to generate compliance reports before enforcing a policy.
Why candidates choose this
Candidates may think Audit is sufficient to enforce compliance by alerting, but they overlook that it lacks the ability to prevent non-compliant resource creation.
✗AppendWrong answer — click to see why▾
Why this is wrong here
Append adds the missing tag to non-compliant resources but does not block creation; it only remediates after the fact, whereas the requirement is to block creation of untagged resources.
★ When this WOULD be the correct answer
Use Append when you want to automatically add a required tag (e.g., Department) to resources that are created without it, without blocking the creation. For example, a policy that ensures all new resources get a 'CostCenter' tag by appending it if missing.
Why candidates choose this
Candidates may think Append will enforce the tag by adding it, but they overlook that it does not prevent creation of non-compliant resources; it only modifies them after creation.
✗DisabledWrong answer — click to see why▾
Why this is wrong here
The 'Disabled' effect deactivates the policy, meaning it does not block or audit resources; thus it cannot prevent creation of untagged resources.
★ When this WOULD be the correct answer
Use 'Disabled' when you want to temporarily turn off a policy without deleting it, such as during maintenance or testing, while retaining the policy definition for future use.
Why candidates choose this
Candidates might think 'Disabled' is a safe choice to avoid enforcement, but it fails to meet the requirement of blocking untagged resources.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.