AZ-104 Manage Azure Identities and Governance Practice Question
An administrator assigned a policy definition with the Modify effect to add tag Environment=Prod to resources in a subscription. Existing VMs still do not show the tag. Which two actions should the administrator take to bring the existing VMs into compliance? Select two.
⚠ Common exam trap
It's easy for candidates to assume the Modify effect automatically applies to existing resources, but in reality, it only affects new resources unless a remediation task is explicitly created.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a remediation task for the policy assignment.
A is correct because a policy with the Modify effect does not automatically apply to existing non-compliant resources; a remediation task must be triggered to evaluate and update those resources. Remediation uses the managed identity assigned to the policy to perform the modification, which is why verifying that identity has the necessary permissions (option B) is also required. Without remediation, only new resources created after the policy assignment will have the tag applied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a remediation task for the policy assignment.
Why this is correct
A modify-effect policy only evaluates new or updated resources unless you explicitly remediate the existing inventory. Creating a remediation task triggers the assignment's managed identity to run the modify operation against all current non-compliant resources at the assigned scope, bringing them into compliance by adding the required tag. Without this step, the policy stays non-compliant for pre-existing VMs even though the definition and assignment are correct.
- ✓
Verify that the policy assignment identity has permission to modify tags at the assigned scope.
Why this is correct
The modify effect relies on the policy assignment's managed identity to perform the actual tag writes on Azure resources. If that identity lacks the necessary role (e.g., Contributor or a custom role with Microsoft.Resources/tags/write) at the assigned scope, the remediation task will fail with an authorization error, leaving resources unchanged. You must explicitly grant the identity the correct permissions, separate from the user who created the assignment, because Azure Policy runs as its own security principal.
- ✗
Reassign the policy at the resource group scope only.
Why it's wrong here
Changing the assignment scope to resource group level does not fix the core problem: existing resources are already in scope but were never evaluated for remediation. Azure Policy only applies modify actions during create/update operations or when a remediation task is run; simply moving or reassigning the policy does not retroactively process existing VM tags. The correct action is to keep the current scope and remediate, not to narrow the scope.
When this WOULD be correct
If the question stated that the policy was assigned at the management group but should only apply to a specific resource group, reassigning at the resource group scope would correct the scope and ensure new resources are evaluated correctly.
- ✗
Switch the policy effect to AuditIfNotExists.
Why it's wrong here
AuditIfNotExists is a different effect that only reports compliance by checking whether an audit resource exists; it cannot modify tags or any other property of the VM. Switching to AuditIfNotExists would drop the modify operation entirely, making the policy even less capable of adding the missing tag. Since the stated goal is to actually remediate existing VMs, this change would not achieve the desired outcome and would instead only log non-compliance.
When this WOULD be correct
In a scenario where the goal is to identify non-compliant resources without automatic remediation, and the administrator plans to manually or separately fix them, AuditIfNotExists would be the correct effect to use.
- ✗
Manually tag only the newest virtual machines.
Why it's wrong here
Manually tagging only newly created VMs ignores the bulk of existing non-compliant resources and creates a maintenance burden that is error-prone and inconsistent. More importantly, manual tagging does not leverage Azure Policy's governance enforcement, so there is no assurance that the tag standard is consistently applied across all VMs. A remediation task is the only method that systematically uses the policy assignment's identity to bring existing VMs into compliance without ad hoc human intervention.
When this WOULD be correct
If the policy had the Audit effect and the administrator needed to quickly bring only recently created resources into compliance for a temporary audit, manually tagging the newest VMs could be a rapid workaround.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a remediation task for the policy assignment.Correct answer▾
Why this is correct
A modify-effect policy only evaluates new or updated resources unless you explicitly remediate the existing inventory. Creating a remediation task triggers the assignment's managed identity to run the modify operation against all current non-compliant resources at the assigned scope, bringing them into compliance by adding the required tag. Without this step, the policy stays non-compliant for pre-existing VMs even though the definition and assignment are correct.
✗Reassign the policy at the resource group scope only.Wrong answer — click to see why▾
Why this is wrong here
Reassigning the policy at the resource group scope only does not trigger evaluation or remediation of existing resources; it only changes the assignment scope, leaving existing VMs non-compliant.
★ When this WOULD be the correct answer
If the question stated that the policy was assigned at the management group but should only apply to a specific resource group, reassigning at the resource group scope would correct the scope and ensure new resources are evaluated correctly.
Why candidates choose this
Candidates may think narrowing the scope forces immediate compliance, or confuse scope reassignment with remediation actions.
✗Switch the policy effect to AuditIfNotExists.Wrong answer — click to see why▾
Why this is wrong here
The Modify effect already adds tags; switching to AuditIfNotExists would only audit compliance without remediating existing non-compliant VMs, failing to bring them into compliance.
★ When this WOULD be the correct answer
In a scenario where the goal is to identify non-compliant resources without automatic remediation, and the administrator plans to manually or separately fix them, AuditIfNotExists would be the correct effect to use.
Why candidates choose this
Candidates may think that auditing is a necessary first step before remediation, or confuse the Modify effect with AuditIfNotExists, not realizing that Modify already includes automatic remediation.
✗Manually tag only the newest virtual machines.Wrong answer — click to see why▾
Why this is wrong here
Manually tagging only the newest VMs does not address the policy's requirement to tag all existing resources; the Modify effect requires a remediation task to apply tags to non-compliant resources automatically.
★ When this WOULD be the correct answer
If the policy had the Audit effect and the administrator needed to quickly bring only recently created resources into compliance for a temporary audit, manually tagging the newest VMs could be a rapid workaround.
Why candidates choose this
Candidates may think manual intervention is a quick fix to achieve compliance without understanding that the Modify effect automates remediation, making manual tagging redundant and incomplete.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.