AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Policy assignment details: - Scope: RG-Prod - Policy definition: Add tag Environment=Prod - Effect: Modify Observed result: - New resources are tagged - Existing VMs in RG-Prod remain untagged
Based on the exhibit, an Azure Policy with the Modify effect was assigned to add Environment=Prod to resources in RG-Prod. New resources get the tag, but existing virtual machines still do not have it. What should the administrator do next?
⚠ Common exam trap
Many exam-takers assume Azure Policy automatically remediates all resources at assignment time, but in reality, only new or updated resources are affected unless a remediation task is explicitly created.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a remediation task for the policy assignment.
The Modify effect in Azure Policy automatically applies to new resources during creation or update, but it does not retroactively fix existing non-compliant resources. To apply the tag to existing virtual machines, the administrator must create a remediation task for the policy assignment, which triggers a deployment to modify those resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a remediation task for the policy assignment.
Why this is correct
Modify can add or update the tag for future deployments, but existing resources usually need remediation so the policy engine can apply the change to what is already deployed. A remediation task is the correct next step.
- ✗
Move the policy assignment to the subscription scope.
Why it's wrong here
Changing the assignment scope to the subscription would broaden policy evaluation to every resource group in the subscription, not just RG-Prod, which is not the stated requirement. More importantly, scope changes only affect where the policy is evaluated for new deployments and existing resource compliance reporting; they do not retroactively apply the Modify effect to existing resources. The VMs in RG-Prod would remain noncompliant until a remediation task is triggered. Since the assignment is already at the correct RG scope, moving it adds no corrective value and would wrongly affect unrelated resources.
When this WOULD be correct
A policy assignment at the resource group level is not applying to resources in other resource groups, and the administrator needs to enforce the same policy across all resource groups in the subscription. Moving the assignment to the subscription scope would ensure consistent application.
- ✗
Change the policy effect from Modify to Deny.
Why it's wrong here
Changing the effect to Deny would prevent future noncompliant deployments by blocking creation or update of resources that lack the required tag, but it does nothing to update resources that already exist. Existing VMs in RG-Prod that were deployed before the policy assignment would remain noncompliant, because Deny is evaluated only at resource creation or update time and has no mechanism to backfill properties. Additionally, switching from Modify to Deny would change the enforcement model globally for that scope, potentially blocking legitimate deployments while still leaving the original problem unsolved. To fix existing resources, a remediation task is required, not a different effect.
When this WOULD be correct
This option would be correct if the goal was to prevent any new resources from being created without the required tag, and the question stated that existing resources are already compliant or not a concern. For example, 'You need to ensure all new resources in RG-Prod automatically have the Environment=Prod tag, but existing resources are already tagged correctly.'
- ✗
Add a CanNotDelete lock to RG-Prod.
Why it's wrong here
Adding a CanNotDelete lock to RG-Prod prevents users from deleting the resource group or any contained resources, which is an access-control safeguard distinct from compliance enforcement. It has no effect on tag evaluation or modification; locks do not trigger Azure Policy evaluation or alter resource properties. The existing VMs would remain noncompliant, and no tagging backfill would occur. Since the requirement is to ensure the tag is added to existing resources, a lock is completely unrelated to the policy remediation workflow and cannot serve as a corrective action.
When this WOULD be correct
An administrator needs to prevent accidental deletion of critical resources in a resource group. A CanNotDelete lock would be the correct action to ensure that no one can delete the resources, even if they have delete permissions.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a remediation task for the policy assignment.Correct answer▾
Why this is correct
Modify can add or update the tag for future deployments, but existing resources usually need remediation so the policy engine can apply the change to what is already deployed. A remediation task is the correct next step.
✗Move the policy assignment to the subscription scope.Wrong answer — click to see why▾
Why this is wrong here
The policy is already assigned at the resource group scope (RG-Prod), and moving it to the subscription scope would not trigger remediation for existing resources; it would only apply to new resources in the subscription. The issue is that existing VMs lack the tag, which requires a remediation task, not a scope change.
★ When this WOULD be the correct answer
A policy assignment at the resource group level is not applying to resources in other resource groups, and the administrator needs to enforce the same policy across all resource groups in the subscription. Moving the assignment to the subscription scope would ensure consistent application.
Why candidates choose this
Candidates may think that a broader scope (subscription) would automatically fix existing resources, not realizing that the Modify effect only applies to new or updated resources unless a remediation task is run.
✗Change the policy effect from Modify to Deny.Wrong answer — click to see why▾
Why this is wrong here
Changing the effect to Deny would block creation or modification of resources that lack the tag, but it does not apply the tag to existing resources. The question specifically asks how to fix existing VMs that are missing the tag, which requires a remediation task, not a policy change.
★ When this WOULD be the correct answer
This option would be correct if the goal was to prevent any new resources from being created without the required tag, and the question stated that existing resources are already compliant or not a concern. For example, 'You need to ensure all new resources in RG-Prod automatically have the Environment=Prod tag, but existing resources are already tagged correctly.'
Why candidates choose this
Candidates may think that changing the effect to Deny will force compliance by blocking non-compliant resources, but they overlook that Deny only affects new or updated resources, not existing ones. They confuse enforcement with remediation.
✗Add a CanNotDelete lock to RG-Prod.Wrong answer — click to see why▾
Why this is wrong here
Adding a CanNotDelete lock to RG-Prod prevents deletion of resources but does not apply tags to existing virtual machines. The issue is that existing resources are not retroactively updated by the Modify effect, which requires a remediation task.
★ When this WOULD be the correct answer
An administrator needs to prevent accidental deletion of critical resources in a resource group. A CanNotDelete lock would be the correct action to ensure that no one can delete the resources, even if they have delete permissions.
Why candidates choose this
Candidates may confuse resource locks with policy remediation, thinking that a lock can enforce compliance or apply tags, when locks only control deletion or modification permissions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Policy assignment
Policy assignment is the process of attaching a set of rules or permissions to a specific resource, user, or group so that those rules are enforced in a cloud or IT environment.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.