AZ-104 Manage Azure Identities and Governance Practice Question
An Azure subscription contains several resource groups. You need to ensure that users can create virtual machines only in regions approved by the security team. Existing noncompliant VMs can remain unchanged. What should you do?
⚠ Common exam trap
Candidates often confuse Azure Policy with Azure RBAC or locks, thinking that restricting permissions or locking resources will control where resources can be created, but only Azure Policy can enforce location-based restrictions at deployment time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign a policy that denies resources in disallowed locations.
Azure Policy can enforce organizational standards by evaluating resources for compliance. The built-in 'Not allowed locations' policy denies the creation of resources in specified regions, ensuring users can only deploy VMs in approved regions. Since the requirement is to allow existing noncompliant VMs to remain unchanged, a deny effect policy (without a 'DeployIfNotExists' or 'Modify' effect) will only affect new deployments, leaving existing resources untouched.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply a ReadOnly lock to each resource group.
Why it's wrong here
A ReadOnly lock at the resource group level blocks all creation, modification, and deletion of resources within that scope, but it does not inspect resource properties such as 'location' and therefore cannot selectively prevent deployments to disallowed regions—it prevents all new deployments, which is an overbroad restriction. Furthermore, locks have no compliance or audit framework, so they cannot produce a policy definition that only targets VMs in unapproved geographies.
When this WOULD be correct
If the requirement was to prevent any changes to existing resources (e.g., to protect critical VMs from accidental deletion or modification), applying a ReadOnly lock to the resource group would be correct.
- ✓
Assign a policy that denies resources in disallowed locations.
Why this is correct
Azure Policy's built-in 'Allowed Locations' definition, applied at the subscription or resource group scope with a deny effect, intercepts deployment requests and rejects any resource whose 'location' property is not in the approved region list. Because enforcement happens during evaluation of new requests, existing VMs already deployed in noncompliant regions remain untouched and continue functioning without requiring migration, making this an elegant, targeted governance mechanism.
- ✗
Create an action group in Azure Monitor.
Why it's wrong here
Action groups are notification and remediation primitives used by alert rules; they can send emails, SMS, or invoke webhooks and runbooks, but they have no ability to intercept or block resource creation at the Azure Resource Manager level. They are reactive and act only after an alert fires, so they would not stop a VM from being provisioned in a disallowed location. Regional deployment governance requires a policy enforcement mechanism, not an alerting sidecar.
When this WOULD be correct
When the question asks how to send email or SMS alerts when a noncompliant VM is created in a disallowed region, creating an action group and linking it to an Azure Policy initiative with a 'deployIfNotExists' effect would be correct.
- ✗
Move all existing VMs to approved regions.
Why it's wrong here
This resolves the current noncompliant state, but the requirement explicitly permits existing resources to remain; forcing a migration causes downtime, data transfer costs, and potential configuration drift without affecting future deployments. Even after moving, any user could still create a new VM in a disallowed region unless a policy is also assigned to deny that action. Therefore, migration is an unnecessary, disruptive measure that fails to address the ongoing control.
When this WOULD be correct
If the requirement were to remediate existing noncompliant VMs by relocating them to approved regions, and the question allowed for moving resources, then moving all existing VMs would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign a policy that denies resources in disallowed locations.Correct answer▾
Why this is correct
Azure Policy's built-in 'Allowed Locations' definition, applied at the subscription or resource group scope with a deny effect, intercepts deployment requests and rejects any resource whose 'location' property is not in the approved region list. Because enforcement happens during evaluation of new requests, existing VMs already deployed in noncompliant regions remain untouched and continue functioning without requiring migration, making this an elegant, targeted governance mechanism.
✗Apply a ReadOnly lock to each resource group.Wrong answer — click to see why▾
Why this is wrong here
A ReadOnly lock prevents all modifications, including creating new VMs, but does not restrict creation to approved regions; it blocks all VM creation regardless of location.
★ When this WOULD be the correct answer
If the requirement was to prevent any changes to existing resources (e.g., to protect critical VMs from accidental deletion or modification), applying a ReadOnly lock to the resource group would be correct.
Why candidates choose this
Candidates may confuse locks with policies, thinking a ReadOnly lock can restrict actions to specific regions, when it actually blocks all write operations indiscriminately.
✗Create an action group in Azure Monitor.Wrong answer — click to see why▾
Why this is wrong here
An action group in Azure Monitor is used for sending notifications or executing automated actions based on alerts, not for restricting VM creation to approved regions.
★ When this WOULD be the correct answer
When the question asks how to send email or SMS alerts when a noncompliant VM is created in a disallowed region, creating an action group and linking it to an Azure Policy initiative with a 'deployIfNotExists' effect would be correct.
Why candidates choose this
Candidates may confuse Azure Monitor's action groups with Azure Policy's enforcement capabilities, thinking that alerts can prevent resource creation rather than just notify after the fact.
✗Move all existing VMs to approved regions.Wrong answer — click to see why▾
Why this is wrong here
Moving all existing VMs to approved regions does not prevent users from creating new VMs in disallowed regions, and the question explicitly states that existing noncompliant VMs can remain unchanged.
★ When this WOULD be the correct answer
If the requirement were to remediate existing noncompliant VMs by relocating them to approved regions, and the question allowed for moving resources, then moving all existing VMs would be correct.
Why candidates choose this
Candidates may think that moving VMs is a straightforward way to enforce compliance, overlooking that the question focuses on preventing future violations, not fixing current ones.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.