Azure Policy Modify Effect: Automatically Add Tags Without Blocking Deployments
Finance wants every resource created in one production resource group to receive the tag CostCenter=FINSVC automatically, but deployments should not be blocked if a template omits the tag. Existing resources should be updated when possible. Which two actions should the administrator take? Select two.
Quick Answer
The answer is to create a policy with the Modify effect and then run a remediation task for noncompliant existing resources. This is correct because the Modify effect automatically adds or updates the CostCenter tag during resource creation or update without blocking the deployment, unlike the Deny effect which would reject the request entirely. For existing resources that are already noncompliant, a remediation task is required to apply the tag retroactively, as the Modify effect only triggers on new or updated resources. On the AZ-104 exam, this scenario tests your understanding of policy effects and the distinction between preventing noncompliant resources (Deny) versus correcting them (Modify), a common trap where students mistakenly choose Deny. Remember the memory tip: “Modify to comply, remediate to apply”—the Modify effect handles new deployments automatically, while remediation fixes what’s already there.
⚠ Common exam trap
Test-takers frequently confuse Audit and Modify effects, thinking Audit can automatically fix tags, or they mistakenly believe a ReadOnly lock is needed to enforce consistency, when in fact Modify with remediation is the correct approach for automatic tag application without blocking deployments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign a Modify policy that adds or updates the CostCenter tag.
A Modify effect policy definition can automatically add or update the CostCenter tag on resources during creation or update, without blocking deployments if the tag is missing. This satisfies the requirement that deployments should not be blocked, as the Modify effect only applies the tag rather than denying non-compliant requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign a Modify policy that adds or updates the CostCenter tag.
Why this is correct
The Modify effect can automatically add or update tags without blocking the deployment. That matches the requirement to keep deployments flowing while enforcing the tag.
- ✓
Run a remediation task for noncompliant existing resources.
Why this is correct
Remediation updates already deployed resources so they can receive the tag as well. Without remediation, the policy would mostly affect new or changed resources.
- ✗
Apply a ReadOnly lock to the resource group to keep tags consistent.
Why it's wrong here
ReadOnly would block normal operational changes, including the tag updates you are trying to automate. It is not a tagging strategy.
When this WOULD be correct
A ReadOnly lock would be correct if the requirement was to prevent any changes to resources in the resource group, such as protecting critical production resources from accidental deletion or modification, and no tag automation was needed.
- ✗
Assign Reader to the resource group to ensure tag visibility.
Why it's wrong here
Reader provides visibility but does not create or modify tags. It has no effect on compliance enforcement.
When this WOULD be correct
This option would be correct if the question asked: 'Management wants all team members to be able to view tags on resources in a resource group, but not modify them. Which role should be assigned?'
- ✗
Use only an Audit policy so teams can see missing tags.
Why it's wrong here
Audit reports noncompliance but does not correct it. The scenario specifically requires automatic tagging when possible.
When this WOULD be correct
This option would be correct if the question asked for a solution that only monitors tag compliance without automatically applying tags, and the organization wants to manually enforce tagging through reports.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign a Modify policy that adds or updates the CostCenter tag.Correct answer▾
Why this is correct
The Modify effect can automatically add or update tags without blocking the deployment. That matches the requirement to keep deployments flowing while enforcing the tag.
✗Apply a ReadOnly lock to the resource group to keep tags consistent.Wrong answer — click to see why▾
Why this is wrong here
Applying a ReadOnly lock prevents any modifications to resources, including adding or updating tags, which contradicts the requirement to automatically apply tags to new resources and update existing ones.
★ When this WOULD be the correct answer
A ReadOnly lock would be correct if the requirement was to prevent any changes to resources in the resource group, such as protecting critical production resources from accidental deletion or modification, and no tag automation was needed.
Why candidates choose this
Candidates may think a lock ensures consistency by preventing changes, but they overlook that it also blocks the automatic tag application and remediation needed to meet the requirement.
✗Assign Reader to the resource group to ensure tag visibility.Wrong answer — click to see why▾
Why this is wrong here
Assigning the Reader role to the resource group ensures tag visibility but does not automatically apply or enforce the CostCenter tag. The requirement is to automatically add the tag to new resources and update existing ones, which requires a policy with a Modify effect, not a role assignment.
★ When this WOULD be the correct answer
This option would be correct if the question asked: 'Management wants all team members to be able to view tags on resources in a resource group, but not modify them. Which role should be assigned?'
Why candidates choose this
Candidates may confuse role-based access control (RBAC) with Azure Policy, thinking that granting read access to tags will help enforce tagging, or they may assume that visibility is a prerequisite for automatic tagging.
✗Use only an Audit policy so teams can see missing tags.Wrong answer — click to see why▾
Why this is wrong here
An Audit policy only reports noncompliance but does not automatically add or update tags. The requirement is to automatically apply the CostCenter tag to new and existing resources, which requires a Modify policy with a remediation task, not just auditing.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a solution that only monitors tag compliance without automatically applying tags, and the organization wants to manually enforce tagging through reports.
Why candidates choose this
Candidates may think an Audit policy is sufficient because it identifies missing tags, but they overlook the requirement for automatic enforcement and remediation of existing resources.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. The finance team wants every resource created in one resource group to carry the same CostCenter tag automatically. They want to reduce manual entry and keep the tag value consistent. What should you configure?
easy- A.Ask users to add the tag manually to every resource
- B.Assign a Reader role to the finance team
- C.Apply a CanNotDelete lock to the resource group
- ✓ D.Use Azure Policy to inherit the CostCenter tag from the resource group
Why D: Azure Policy can enforce tag inheritance from a resource group to all resources within it using the 'Inherit a tag from the resource group' built-in policy effect. This ensures the CostCenter tag is automatically applied to every new or existing resource without manual entry, maintaining consistency and reducing administrative overhead.
Variation 2. A finance team wants every resource created in one production resource group to carry CostCenter=PRD automatically. They do not want deployments blocked if a team forgets the tag, but they do want existing resources and future resources in that resource group to converge on the correct tag value. What should the administrator configure?
hard- A.Apply a CanNotDelete lock to the production resource group.
- ✓ B.Assign a modify policy for CostCenter=PRD at the production resource group scope and create a remediation task.
- C.Assign Contributor on the subscription and require teams to enter the tag manually.
- D.Set the tag on the management group and expect all resources to inherit it automatically.
Why B: Azure Policy with a 'modify' effect can automatically add or correct the CostCenter tag on resources within the specified scope. By assigning the policy at the production resource group scope and creating a remediation task, the policy will audit existing resources and, via a managed identity, apply the tag value to non-compliant resources without blocking deployment. This satisfies the requirement for automatic convergence without preventing creation if the tag is missing.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.