Azure Policy Modify Effect to Auto-Add Tags
Exhibit
Resource group requirement: - Scope: RG-Finance - Every new resource must carry CostCenter=FIN - Missing tag should be added automatically when possible - Deployments must not be blocked Current state: - Teams manually add tags today - Inconsistent tag values are common
Based on the exhibit, every resource created in RG-Finance must automatically receive CostCenter=FIN, but deployments should not fail if the tag is omitted. What should you configure?
Quick Answer
The answer is to assign an Azure Policy with the Modify effect at the RG-Finance scope. This is correct because the Modify effect automatically adds the CostCenter=FIN tag to resources after they are created, without blocking the deployment if the tag is omitted—unlike the Deny effect, which would reject non-compliant resources entirely. On the AZ-104 exam, this scenario tests your understanding of policy effects and remediation tasks, often appearing as a trap where candidates mistakenly choose Deny or Append; remember that Modify can update existing tags and requires a managed identity for remediation, while Append only works on new resources. A key memory tip is “Modify mends, Deny defends”—Modify fixes compliance gaps post-deployment, whereas Deny stops non-compliance upfront.
⚠ Common exam trap
Candidates often confuse the 'Modify' effect with the 'Deny' effect; candidates often choose 'Deny' because it enforces compliance, but fail to notice the requirement that deployments should not fail if the tag is omitted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign an Azure Policy with the Modify effect at RG-Finance.
The Azure Policy 'Modify' effect can automatically add the CostCenter=FIN tag to resources in RG-Finance without causing deployment failures if the tag is omitted. Unlike 'Deny', which blocks non-compliant deployments, 'Modify' uses a remediation task to append the missing tag after creation, ensuring compliance without disruption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign an Azure Policy with the Modify effect at RG-Finance.
Why this is correct
Modify is the right policy effect when you want Azure to add or update a tag without failing the deployment. Assigning it at the resource group ensures the requirement applies only to RG-Finance and keeps the CostCenter value consistent.
- ✗
Assign an RBAC role that forces all users to enter the tag.
Why it's wrong here
RBAC cannot force tag values in the deployment payload. It only controls whether the user is authorized to create or manage resources.
When this WOULD be correct
If the question required preventing unauthorized users from modifying resources in RG-Finance, assigning a custom RBAC role with restricted permissions (e.g., Contributor without tag write access) would be correct.
- ✗
Apply a ReadOnly lock to the resource group.
Why it's wrong here
A ReadOnly lock blocks changes and would prevent normal resource creation or updates. It does not help with automated tagging.
When this WOULD be correct
You need to prevent accidental deletion or modification of critical resources in a resource group, but users should still be able to read them. A ReadOnly lock would be correct in that scenario.
- ✗
Use Azure Policy with a Deny effect at the management group.
Why it's wrong here
Deny would block deployments that miss the tag, which conflicts with the requirement that deployments should not fail. The scope is also broader than necessary.
When this WOULD be correct
If the requirement were to enforce that all resources in a management group hierarchy must have a specific tag, and any resource without it should be denied creation, then assigning an Azure Policy with the Deny effect at the management group would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign an Azure Policy with the Modify effect at RG-Finance.Correct answer▾
Why this is correct
Modify is the right policy effect when you want Azure to add or update a tag without failing the deployment. Assigning it at the resource group ensures the requirement applies only to RG-Finance and keeps the CostCenter value consistent.
✗Assign an RBAC role that forces all users to enter the tag.Wrong answer — click to see why▾
Why this is wrong here
RBAC roles cannot force users to enter tags; they control permissions, not resource properties. The requirement is to automatically add a tag without failing deployments, which RBAC cannot enforce.
★ When this WOULD be the correct answer
If the question required preventing unauthorized users from modifying resources in RG-Finance, assigning a custom RBAC role with restricted permissions (e.g., Contributor without tag write access) would be correct.
Why candidates choose this
Candidates may confuse RBAC with policy enforcement, thinking that restricting permissions can force tag entry, but RBAC does not validate or add tags automatically.
✗Apply a ReadOnly lock to the resource group.Wrong answer — click to see why▾
Why this is wrong here
A ReadOnly lock prevents modifications to resources but does not enforce tagging. The requirement is to automatically add a tag without failing deployments, which a lock cannot achieve.
★ When this WOULD be the correct answer
You need to prevent accidental deletion or modification of critical resources in a resource group, but users should still be able to read them. A ReadOnly lock would be correct in that scenario.
Why candidates choose this
Candidates may confuse locks with policy enforcement, thinking a lock can force tag compliance, or they may overlook that locks only restrict operations, not add metadata.
✗Use Azure Policy with a Deny effect at the management group.Wrong answer — click to see why▾
Why this is wrong here
The Deny effect would block resource creation if the tag is missing, causing deployments to fail, which contradicts the requirement that deployments should not fail if the tag is omitted.
★ When this WOULD be the correct answer
If the requirement were to enforce that all resources in a management group hierarchy must have a specific tag, and any resource without it should be denied creation, then assigning an Azure Policy with the Deny effect at the management group would be correct.
Why candidates choose this
Candidates may think that a Deny policy at a higher scope (management group) is a stronger way to enforce tagging, but they overlook the requirement that deployments should not fail when the tag is omitted.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to ensure that all new resources deployed to a subscription automatically receive a CostCenter tag with a default value if the tag is omitted during deployment. Which Azure governance feature should you use?
medium- A.A resource lock
- ✓ B.An Azure Policy with an append or modify effect
- C.A management group lock
- D.A custom RBAC role
Why B: Azure Policy with an append or modify effect can automatically add a CostCenter tag with a default value to resources that are missing it during deployment. The append effect adds the tag and value at creation time, while the modify effect (using a 'addOrReplace' operation) can also update existing resources. This ensures governance compliance without manual intervention.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.