Manage Azure Identities and Governance →easyMultiple ChoiceObjective-mapped

AZ-104 Manage Azure Identities and Governance Practice Question

Exhibit

Policy definitions to combine

1. Allowed locations
2. Require costCenter tag on resource groups
3. Allowed virtual machine SKUs

Target scope:
Management group: corp-root
Desired outcome:
- Assign the three controls as a single package
- Review compliance from one place

Based on the exhibit, the governance team wants to assign three related policy definitions together: allowed regions, required tags, and approved VM SKUs. What should the administrator create first?

⚠ Common exam trap

Test-takers frequently confuse a policy initiative with a resource lock or RBAC role, thinking that administrative controls are needed to enforce the grouping, when in fact the initiative itself is the native Azure construct for bundling policy definitions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A policy initiative that groups the three policy definitions into one object.

A policy initiative (also known as a policy set) is the correct answer because it allows you to group multiple related policy definitions into a single assignable object. This is the intended Azure governance pattern for bundling policies like allowed regions, required tags, and approved VM SKUs, ensuring they are applied together consistently across management groups or subscriptions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
A policy initiative that groups the three policy definitions into one object.
Why this is correct
An initiative is designed to bundle multiple policy definitions into a single reusable unit. This lets the administrator assign and report on the controls together at the management group scope. It is the correct choice when several related governance rules should be managed as one baseline.
✗
A resource lock so the policies cannot be changed after assignment.
Why it's wrong here
A resource lock is a protection mechanism that prevents deletion or modification of an Azure resource, but it cannot bundle multiple policy definitions into a single reusable object. Resource locks operate at the resource level (e.g., ReadOnly or CanNotDelete) and have no effect on how policy definitions are grouped or assigned. Even if you locked a policy assignment, you would still need to assign each of the three definitions individually—the lock does not provide combined compliance reporting or a unified governance baseline.
When this WOULD be correct
A resource lock would be correct if the question were: 'After assigning the three policies, the administrator wants to prevent the policy assignment from being deleted or modified. What should be created?'
✗
A custom RBAC role that grants permission to edit policy assignments.
Why it's wrong here
RBAC controls who can manage policies, not how policy definitions are grouped. A custom role would help authorize administrators, but it would not create a single package containing multiple policy rules. The question is about policy structure, not user permissions.
When this WOULD be correct
A custom RBAC role would be correct if the question asked: 'The security team needs to allow junior administrators to modify policy assignments without granting them full owner rights. What should they create?'
✗
A management group exemption so all three rules apply automatically.
Why it's wrong here
A management group is a hierarchical container for organizing and managing subscriptions, not a packaging construct for policy definitions. An exemption in Azure Policy is used to exclude specific resources or scopes from policy evaluation, effectively disabling enforcement for those rules—so it would do the opposite of what the governance team wants. The team needs an initiative definition, which is a policy-level object that aggregates multiple definitions into one assignable unit; a management group exemption cannot apply the three rules automatically and would instead remove their effect.
When this WOULD be correct
An administrator needs to exclude a specific subscription from a policy that enforces tagging, while still applying the policy to all other subscriptions in the management group. Creating an exemption at the subscription level would be correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

✓A policy initiative that groups the three policy definitions into one object.Correct answer▾

Why this is correct

An initiative is designed to bundle multiple policy definitions into a single reusable unit. This lets the administrator assign and report on the controls together at the management group scope. It is the correct choice when several related governance rules should be managed as one baseline.

✗A resource lock so the policies cannot be changed after assignment.Wrong answer — click to see why▾

Why this is wrong here

The question asks what to create first to group three policy definitions together. A resource lock prevents accidental deletion or modification of resources but does not group policies; it is unrelated to the requirement.

★ When this WOULD be the correct answer

A resource lock would be correct if the question were: 'After assigning the three policies, the administrator wants to prevent the policy assignment from being deleted or modified. What should be created?'

Why candidates choose this

Candidates may confuse the need to protect the policy assignment with the need to group policies, thinking a lock ensures the policies stay in place.

✗A custom RBAC role that grants permission to edit policy assignments.Wrong answer — click to see why▾

Why this is wrong here

Creating a custom RBAC role that grants permission to edit policy assignments does not group policy definitions together; it only controls who can modify assignments. The question asks for grouping three policy definitions, which is achieved by a policy initiative, not by managing permissions.

★ When this WOULD be the correct answer

A custom RBAC role would be correct if the question asked: 'The security team needs to allow junior administrators to modify policy assignments without granting them full owner rights. What should they create?'

Why candidates choose this

Candidates may confuse the need to manage policy assignments with the need to group policies, or think that a custom role is required to handle the grouping of policies.

✗A management group exemption so all three rules apply automatically.Wrong answer — click to see why▾

Why this is wrong here

An exemption is used to exclude specific scopes from policy enforcement, not to group policies together. The question asks for grouping three policy definitions, which requires an initiative, not an exemption.

★ When this WOULD be the correct answer

An administrator needs to exclude a specific subscription from a policy that enforces tagging, while still applying the policy to all other subscriptions in the management group. Creating an exemption at the subscription level would be correct.

Why candidates choose this

Candidates may confuse 'exemption' with 'assignment' or think that an exemption can automatically apply multiple rules, misunderstanding its purpose as a tool for policy grouping.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

AZ-104 Manage Azure Identities and Governance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question