AZ-104 Manage Azure Identities and Governance Practice Question
An operations team must enforce two rules across all subscriptions in a department: new resources must include a CostCenter tag, and deployments are allowed only in East US and West US. The team wants one assignment and automatic blocking of noncompliant deployments. Which three actions should the administrator take? Select three.
⚠ Common exam trap
Test-takers frequently confuse RBAC roles (like Contributor) with Azure Policy effects, mistakenly thinking granting permissions can enforce compliance, or they confuse resource locks with policy enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Azure Policy initiative that contains both policy definitions.
An Azure Policy initiative (a set of policy definitions) allows combining the CostCenter tag requirement and the allowed region restriction into a single assignment, simplifying management. This ensures both rules are enforced together across all subscriptions in the department.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an Azure Policy initiative that contains both policy definitions.
Why this is correct
An Azure Policy initiative (policySetDefinition) bundles multiple related policy definitions into a single assignable unit, enabling the operations team to manage the tag and location requirements as one cohesive governance package. Instead of assigning two separate policies, an initiative simplifies administration, keeps related rules organized, and ensures that both definitions are always evaluated together consistently across all resources.
- ✓
Assign the initiative at the management group scope that contains the department subscriptions.
Why this is correct
Assigning the initiative at the management group scope that contains the department subscriptions is essential because it applies the policy recursively to every subscription, resource group, and resource within that management group. This centralized approach avoids the need to duplicate assignments in each subscription, guarantees uniform enforcement as new subscriptions are added, and eliminates the risk of gaps or drift from per-subscription assignments.
- ✓
Use the Deny effect for both policy definitions.
Why this is correct
The Deny effect is the correct choice because it actively blocks any deployment that violates the tag or location requirements at the time of creation. Unlike Audit, which merely flags noncompliant resources, or Modify, which attempts remediation, Deny prevents the resource from being provisioned altogether. This provides immediate, hard enforcement and ensures the operations team's rules are satisfied before resources enter their environment.
- ✗
Grant Contributor at the subscription scope.
Why it's wrong here
Granting Contributor at the subscription scope is an RBAC permission, not a policy control, and it does nothing to enforce tag or location compliance. Contributor grants users the ability to create and manage all resources, which actually increases their ability to deploy noncompliant resources rather than preventing it. Even if a user is a Contributor, Azure Policy rules still apply, but the assignment itself cannot mandate the required tags or restrict regions.
When this WOULD be correct
In a scenario where the goal is to allow a team to manage resources within a subscription but not at a higher scope, and no policy enforcement is needed, assigning Contributor at the subscription scope would be correct.
- ✗
Apply a CanNotDelete lock to each resource group.
Why it's wrong here
A CanNotDelete lock on each resource group protects resources from being deleted or modified, but it does not govern deployment characteristics such as required tags or allowed locations. Locks are intended to prevent accidental or malicious deletion, not to enforce compliance rules on resource creation. A user could still create a storage account without the required tag or in a disallowed region while the lock remains in effect, so this approach fails to meet either of the stated requirements.
When this WOULD be correct
An administrator needs to prevent accidental deletion of critical resource groups in a production environment, while still allowing modifications to resources within them.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create an Azure Policy initiative that contains both policy definitions.Correct answer▾
Why this is correct
An Azure Policy initiative (policySetDefinition) bundles multiple related policy definitions into a single assignable unit, enabling the operations team to manage the tag and location requirements as one cohesive governance package. Instead of assigning two separate policies, an initiative simplifies administration, keeps related rules organized, and ensures that both definitions are always evaluated together consistently across all resources.
✗Grant Contributor at the subscription scope.Wrong answer — click to see why▾
Why this is wrong here
Granting Contributor at the subscription scope does not enforce tagging or location restrictions; it grants broad permissions to manage resources, not block noncompliant deployments.
★ When this WOULD be the correct answer
In a scenario where the goal is to allow a team to manage resources within a subscription but not at a higher scope, and no policy enforcement is needed, assigning Contributor at the subscription scope would be correct.
Why candidates choose this
Candidates may think Contributor role can enforce policies or that a role assignment is needed for policy assignment, but policies are assigned separately and Contributor does not block deployments.
✗Apply a CanNotDelete lock to each resource group.Wrong answer — click to see why▾
Why this is wrong here
Applying a CanNotDelete lock prevents deletion of resource groups but does not enforce tagging or restrict deployment locations, which are the requirements in this question.
★ When this WOULD be the correct answer
An administrator needs to prevent accidental deletion of critical resource groups in a production environment, while still allowing modifications to resources within them.
Why candidates choose this
Candidates may confuse resource locks with policy enforcement, thinking that locks can block noncompliant deployments, but locks only prevent deletion or modification, not creation of resources.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Initiative
An initiative is a formal, structured effort or project undertaken by an organization to achieve a specific strategic goal, often involving changes to IT systems, policies, or processes.
Key term
Region
A region is a distinct geographic location where a cloud provider operates multiple data centers that are connected by low-latency networks and provide cloud services.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.