Using Azure Policy Initiative to Enforce Multiple Controls Across Subscriptions
Security wants one assignment that enforces all of these controls across several subscriptions: allowed Azure regions, required tags, and disabling public network access on specific resources. Which Azure feature should you use?
Quick Answer
The answer is an Azure Policy initiative, which is the correct choice because it groups multiple related policy definitions into a single assignable unit, allowing you to enforce controls like allowed Azure regions, required tags, and disabling public network access across several subscriptions with one assignment. This keeps each rule as a separate, granular policy definition for easier management while satisfying the security requirement for a unified enforcement point. On the AZ-104 exam, this tests your understanding of policy sets versus individual policies, with a common trap being selecting a single policy definition or a management group structure instead. Remember that an initiative is a "policy bundle" for multi-control scenarios—think of it as a checklist that applies all rules at once, not one rule at a time. A memory tip: "Initiative = multiple policies in one assignment."
⚠ Common exam trap
It's easy for candidates to think a single policy definition can contain multiple rules (like a JSON array of conditions), but Azure Policy requires each definition to have exactly one policyRule, so an initiative is the only way to bundle separate controls into one assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An Azure Policy initiative that contains multiple related policy definitions
An Azure Policy initiative (also called a policy set) is the correct choice because it groups multiple independent policy definitions into a single assignable unit. This allows you to enforce all three distinct controls—allowed regions, required tags, and disabling public network access—across several subscriptions in one assignment, while keeping each rule as a separate policy definition for easier management and granular effect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A single Azure Policy definition with one rule for all three controls
Why it's wrong here
One policy definition usually targets one logical control; these requirements are better grouped together.
When this WOULD be correct
This option would be correct if the question asked for enforcing a single control, such as 'allowed Azure regions only' across multiple subscriptions. A single policy definition is sufficient for one rule.
- ✓
An Azure Policy initiative that contains multiple related policy definitions
Why this is correct
An initiative lets you group multiple policies into one assignment, which is ideal for enforcing a broader security baseline.
- ✗
A management group lock applied to the subscriptions
Why it's wrong here
Locks do not evaluate compliance or enforce multiple configuration standards.
When this WOULD be correct
An exam question asks: 'You need to prevent all users from deleting a critical subscription. Which feature should you use?' In that case, a management group lock (specifically a CanNotDelete lock) would be correct.
- ✗
A custom RBAC role assigned at the management group
Why it's wrong here
RBAC grants access, but it does not enforce configuration or compliance settings.
When this WOULD be correct
A custom RBAC role assigned at the management group would be correct if the question asked for granting a specific set of permissions (e.g., 'allow read access to all resources but prevent deletion') across multiple subscriptions, without requiring policy enforcement.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An Azure Policy initiative that contains multiple related policy definitionsCorrect answer▾
Why this is correct
An initiative lets you group multiple policies into one assignment, which is ideal for enforcing a broader security baseline.
✗A single Azure Policy definition with one rule for all three controlsWrong answer — click to see why▾
Why this is wrong here
A single Azure Policy definition can only enforce one rule (e.g., allowed regions, required tags, or disabling public network access), not all three controls simultaneously. The question requires multiple controls, which necessitates an initiative (a collection of definitions).
★ When this WOULD be the correct answer
This option would be correct if the question asked for enforcing a single control, such as 'allowed Azure regions only' across multiple subscriptions. A single policy definition is sufficient for one rule.
Why candidates choose this
Candidates may think a single policy definition can contain multiple rules (like an if-then statement with multiple conditions), but Azure Policy definitions are limited to one effect per definition. They confuse a policy definition's flexibility with an initiative's grouping capability.
✗A management group lock applied to the subscriptionsWrong answer — click to see why▾
Why this is wrong here
A management group lock prevents accidental deletion or modification of resources, but it cannot enforce allowed regions, required tags, or disable public network access. Locks do not apply policy controls.
★ When this WOULD be the correct answer
An exam question asks: 'You need to prevent all users from deleting a critical subscription. Which feature should you use?' In that case, a management group lock (specifically a CanNotDelete lock) would be correct.
Why candidates choose this
Candidates may confuse management group locks with policy enforcement, thinking a lock can enforce compliance rules, when locks only protect against deletion or modification.
✗A custom RBAC role assigned at the management groupWrong answer — click to see why▾
Why this is wrong here
Custom RBAC roles control permissions (who can do what), not enforcement of resource configurations like allowed regions, tags, or network settings. The question asks for enforcing controls, not granting permissions.
★ When this WOULD be the correct answer
A custom RBAC role assigned at the management group would be correct if the question asked for granting a specific set of permissions (e.g., 'allow read access to all resources but prevent deletion') across multiple subscriptions, without requiring policy enforcement.
Why candidates choose this
Candidates may confuse RBAC with policy because both can be assigned at management groups and affect multiple subscriptions, but RBAC governs access, not compliance or configuration enforcement.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Initiative
An initiative is a formal, structured effort or project undertaken by an organization to achieve a specific strategic goal, often involving changes to IT systems, policies, or processes.
Key term
Policy definition
A policy definition is a formal rule or set of rules that specifies allowed or denied actions on resources within an IT environment, often used for governance, compliance, and security control.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to enforce three controls across all current and future subscriptions under a management group: allowed Azure regions, a required cost center tag, and approved VM SKUs. Central IT wants a single assignment and consolidated compliance reporting. What should they use?
medium- A.Three separate policy assignments at each subscription scope.
- ✓ B.One initiative assignment at the management group scope.
- C.A resource lock on the management group to prevent noncompliant deployments.
- D.A custom RBAC role assigned to the management group.
Why B: An initiative (policy set) at the management group scope allows you to bundle multiple policy definitions (allowed regions, required tag, approved VM SKUs) into a single assignment. This ensures the controls apply to all current and future subscriptions under that management group, and Azure Policy provides consolidated compliance reporting at the management group level, meeting the requirement for a single assignment and unified view.
Variation 2. An operations team must enforce two rules across all subscriptions in a department: new resources must include a CostCenter tag, and deployments are allowed only in East US and West US. The team wants one assignment and automatic blocking of noncompliant deployments. Which three actions should the administrator take? Select three.
medium- ✓ A.Create an Azure Policy initiative that contains both policy definitions.
- ✓ B.Assign the initiative at the management group scope that contains the department subscriptions.
- ✓ C.Use the Deny effect for both policy definitions.
- D.Grant Contributor at the subscription scope.
- E.Apply a CanNotDelete lock to each resource group.
Why A: An Azure Policy initiative (a set of policy definitions) allows combining the CostCenter tag requirement and the allowed region restriction into a single assignment, simplifying management. This ensures both rules are enforced together across all subscriptions in the department.
Variation 3. A platform team must enforce two governance rules across every current and future subscription under a management group: resources must include an Environment tag, and only East US or West US may be used for deployment. They want one compliance view for both rules and a way to correct missing tags on existing resources where supported. What should they assign?
hard- A.Assign two separate policies manually to each subscription and skip remediation.
- ✓ B.Assign an initiative at the management group scope that contains the tag and allowed-location policies, then remediate the tag policy.
- C.Assign Contributor to the management group so administrators can fix any noncompliant resource manually.
- D.Apply a CanNotDelete lock at the management group scope to prevent drift.
Why B: An initiative (policy set) at the management group scope enforces both the required tag and allowed-location rules across all current and future subscriptions in a single compliance view. The tag policy can be remediated using a remediation task with a managed identity to automatically add missing tags on existing resources where supported (e.g., via modify effect). This approach centralizes governance without manual per-subscription assignment.
Variation 4. A platform team must enforce two governance rules across every current and future subscription under a management group: only East US and West US deployments are allowed, and every resource must include an Environment tag. Which three actions should the administrator take? Select three.
medium- ✓ A.Create a policy initiative that groups the governance requirements.
- ✓ B.Assign the initiative at the management group scope.
- ✓ C.Include both the allowed locations policy and the required Environment tag policy in the initiative.
- D.Assign the policies separately to each existing subscription only.
- E.Use an RBAC Contributor role to enforce region and tag compliance.
Why A: A policy initiative (also known as a policy set) allows you to group multiple individual Azure Policy definitions into a single, reusable governance package. This simplifies assignment and ensures both the allowed locations and required tag policies are enforced together consistently across all subscriptions under the management group.
Variation 5. A platform team must enforce three governance rules across every subscription in a management group: allowed Azure regions, required Environment tags, and approved VM sizes. They want one assignment that groups the rules together and gives a single compliance view. What should they use?
medium- A.A single RBAC role assignment at the management group.
- B.A management lock on each subscription.
- ✓ C.An Azure Policy initiative assigned at the management group.
- D.A private endpoint for Azure Resource Manager.
Why C: An Azure Policy initiative (also known as a policy set) allows you to group multiple individual policy definitions—such as allowed regions, required tags, and approved VM sizes—into a single assignment. When assigned at the management group scope, the initiative enforces all three rules across every subscription within that group and provides a unified compliance view in the Azure Policy dashboard, meeting the team's requirement for consolidated governance.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.