AZ-104 Manage Azure Identities and Governance Practice Question
An enterprise wants one governance package to be applied automatically to every production subscription that is added in the future. The package contains several policy definitions that should be managed together. Which two actions are required? Select two.
⚠ Common exam trap
Many candidates confuse resource locks with policy assignments, thinking locks can enforce policy inheritance, when in fact locks only prevent deletion or modification and have no effect on policy application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create or use a production management group and assign the governance package at that scope.
Assigning the governance package (policy initiative) at the management group scope ensures that all child subscriptions, including future ones, automatically inherit the policies. Management groups provide hierarchical governance, and any subscription added under that management group will inherit the assigned policies without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create or use a production management group and assign the governance package at that scope.
Why this is correct
Management groups are the correct hierarchy for automatic inheritance across multiple subscriptions. Assigning governance at the management-group scope ensures every child production subscription receives the baseline without separate manual work. This satisfies the requirement for future subscriptions as well as existing ones.
- ✓
Package the related policy definitions into a policy initiative before assigning them.
Why this is correct
A policy initiative groups multiple policy definitions so they can be assigned and managed together. That makes the governance package easier to deploy, maintain, and report on. It is the natural fit when several policies must travel as one baseline.
- ✗
Assign each policy separately to every resource group so the settings are inherited upward.
Why it's wrong here
Resource-group assignments do not scale well for subscription-wide governance and they do not create an automatic baseline for future subscriptions. Policies also inherit from higher scopes downward, not upward. This approach reverses the intended design.
When this WOULD be correct
If the question asked for applying policies to specific existing resource groups within a single subscription, and inheritance upward was not needed, assigning each policy separately to those resource groups would be correct.
- ✗
Use tags on resources to make policy definitions automatically apply to new subscriptions.
Why it's wrong here
Tags are simply metadata represented as key-value pairs on Azure resources or resource groups; they do not carry any enforcement or inheritance behavior. Assigning tags in no way causes policy definitions to be applied to a subscription or to any future subscription. To make policies apply, you must explicitly assign the policy or initiative to a scope like a management group or subscription. This option confuses classification with enforcement: tags can be used as policy conditions, but they are not a substitute for a scope assignment.
When this WOULD be correct
If the question asked how to target policy enforcement to specific resources based on cost center or environment, using tags in a policy definition's 'if' condition would be correct. For example, 'Apply a policy to all resources tagged with Environment=Production'.
- ✗
Apply a resource lock to the management group so all child subscriptions inherit the policies.
Why it's wrong here
Resource locks protect specific resources or scopes from certain operations, but they do not define or distribute policies. A lock is not a governance package and does not replace policy assignment. It solves a different problem entirely.
When this WOULD be correct
If the question asked: 'An administrator needs to prevent accidental deletion of a management group hierarchy that contains critical subscriptions. Which action should be taken?' Then applying a resource lock to the management group would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create or use a production management group and assign the governance package at that scope.Correct answer▾
Why this is correct
Management groups are the correct hierarchy for automatic inheritance across multiple subscriptions. Assigning governance at the management-group scope ensures every child production subscription receives the baseline without separate manual work. This satisfies the requirement for future subscriptions as well as existing ones.
✗Assign each policy separately to every resource group so the settings are inherited upward.Wrong answer — click to see why▾
Why this is wrong here
Assigning policies to individual resource groups does not automatically apply to new subscriptions; the question requires automatic application to future production subscriptions, which demands assignment at a management group scope, not resource groups.
★ When this WOULD be the correct answer
If the question asked for applying policies to specific existing resource groups within a single subscription, and inheritance upward was not needed, assigning each policy separately to those resource groups would be correct.
Why candidates choose this
Candidates may think that assigning policies to resource groups ensures coverage of all resources, and mistakenly believe that inheritance works upward from resource groups to subscriptions, which is incorrect in Azure.
✗Use tags on resources to make policy definitions automatically apply to new subscriptions.Wrong answer — click to see why▾
Why this is wrong here
Tags do not automatically apply policy definitions to new subscriptions; they are metadata on resources. Policies must be assigned at a management group or subscription scope to affect new subscriptions.
★ When this WOULD be the correct answer
If the question asked how to target policy enforcement to specific resources based on cost center or environment, using tags in a policy definition's 'if' condition would be correct. For example, 'Apply a policy to all resources tagged with Environment=Production'.
Why candidates choose this
Candidates may confuse tags as a mechanism for automatic policy application, thinking that tagging a subscription or management group triggers policy inheritance, rather than understanding tags are resource-level metadata used in policy conditions.
✗Apply a resource lock to the management group so all child subscriptions inherit the policies.Wrong answer — click to see why▾
Why this is wrong here
Resource locks prevent accidental deletion or modification but do not enforce policy definitions. The question requires automatic application of a governance package to new subscriptions, which resource locks cannot achieve.
★ When this WOULD be the correct answer
If the question asked: 'An administrator needs to prevent accidental deletion of a management group hierarchy that contains critical subscriptions. Which action should be taken?' Then applying a resource lock to the management group would be correct.
Why candidates choose this
Candidates may confuse resource locks with policy assignments, thinking locks can enforce governance settings, or they may believe locks can propagate policies to child resources.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants development and production workloads for the same application to have separate budgets, separate subscription administrators, and different access controls. The central IT team still wants to apply the same security policies to both environments. What is the best design?
medium- A.Use one subscription and separate the environments with tags only
- B.Use one management group and two resource groups, one for dev and one for prod
- ✓ C.Create a separate subscription for dev and prod, then place both subscriptions under the same management group
- D.Put production in a management group and development in a resource group
Why C: It uses separate subscriptions for development and production, which provides independent budget tracking, subscription-level role assignments, and separate administrators. Placing both subscriptions under the same management group allows the central IT team to apply consistent Azure Policy and RBAC security policies across both environments via the management group hierarchy, ensuring governance without compromising isolation.
Variation 2. A department has 10 subscriptions and wants the same two governance rules applied to all current and future subscriptions. One rule audits missing tags, and the other denies unapproved locations. Which two actions should the administrator take? Select two.
medium- ✓ A.Create an Azure Policy initiative that contains both policy definitions.
- ✓ B.Assign the initiative at the management group scope.
- C.Assign each policy only to one resource group.
- D.Use Azure RBAC instead of Policy for both requirements.
- E.Create a read-only lock on each subscription.
Why A: Azure Policy Initiative allows grouping multiple policy definitions (like audit for missing tags and deny for unapproved locations) into a single set for coordinated enforcement. Assigning the initiative at the management group scope ensures it applies to all current and future subscriptions under that management group, meeting the requirement for consistent governance across all 10 subscriptions and any new ones added later.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.