AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Azure hierarchy: Tenant root ├── Platform-MG │ ├── Prod-MG │ └── Sandbox-MG Requirement: - New subscription: Finance-Prod - It must inherit the production policy baseline and reporting settings automatically.
Based on the exhibit, where should the new subscription be placed so it inherits the production governance baseline automatically?
⚠ Common exam trap
Many exam-takers think creating a resource group with a descriptive name (like Finance-Prod) is sufficient to apply governance, but Azure governance inheritance only flows through management group hierarchy, not through resource group naming conventions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the subscription under Prod-MG.
Placing the new subscription under the Prod-MG management group ensures it automatically inherits the Azure Policy and RBAC assignments applied at that level. Management groups in Azure allow hierarchical governance, and any subscription within a management group inherits policies and role assignments from that group and all parent groups. This enables consistent enforcement of the production governance baseline without manual configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Place the subscription under Prod-MG.
Why this is correct
Placing the new subscription under Prod-MG is correct because management group inheritance automatically applies the same Azure Policy, RBAC role assignments, and budget guardrails already configured for production workloads to this subscription without any extra setup. This is the standard pattern for centralized governance: as soon as the subscription is created under Prod-MG, it inherits the parent's controls, ensuring finance production resources comply with mandatory tagging, allowed regions, and cost limits from day one. The subscription also sits at the correct level in the hierarchy so that any future nested management groups or policy exemptions explicitly scoped to Prod-MG will behave as expected.
- ✗
Place the subscription under Sandbox-MG.
Why it's wrong here
Placing the subscription under Sandbox-MG applies the incorrect governance baseline because Sandbox-MG is designed for nonproduction subscriptions with relaxed policies, lower cost limits, and fewer denial actions. A production finance subscription would inherit those permissive settings, potentially allowing deployment into disallowed regions, missing mandatory tags, or bypassing approval workflows that Prod-MG enforces. Since management group inheritance is automatic and cannot be selectively disabled for individual policies at the child level unless an explicit exemption is created, this placement would require significant remediation and policy reconfiguration to bring the subscription into compliance with intended production standards.
When this WOULD be correct
If the question asked for a subscription that should NOT inherit production governance, such as for testing or development, placing it under Sandbox-MG would be correct.
- ✗
Create a resource group named Finance-Prod instead of assigning a management group.
Why it's wrong here
Creating a resource group named Finance-Prod cannot replace the need to place the subscription under Prod-MG because a resource group is a container within a subscription, not a parent in the management group hierarchy. Management groups exist above subscriptions and are the only construct that propagates governance policies across an entire subscription; a resource group name carries no inheritance properties. Even if the resource group is later created, the subscription itself would still be at the tenant root or inherited from an unintended management group, leaving the production governance baseline unapplied to other resource groups in the same subscription.
When this WOULD be correct
This option would be correct if the question asked for a way to organize resources within a subscription without inheriting management group policies, such as when deploying a project that needs custom policies not aligned with the production baseline.
- ✗
Move the subscription to the tenant root and assign policies later.
Why it's wrong here
Moving the subscription to the tenant root and assigning policies later is the wrong approach because it initially leaves the new subscription without any inherited management group controls, creating a window where resources could be deployed with noncompliant configurations or without required tags. The tenant root is the widest possible scope and applies only to policies assigned at that root—which typically does not include the production-specific guardrails that belong under Prod-MG. Delaying assignment also violates the principle of policy-as-code and makes governance reactive rather than enforcing compliance at the moment of subscription creation, increasing the chance of deployment drift.
When this WOULD be correct
This option would be correct in a scenario where the question asks for the best practice to avoid inheriting any existing policies or governance baselines, such as when setting up a completely isolated subscription for testing or a new environment that should not be affected by current management group policies.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Place the subscription under Prod-MG.Correct answer▾
Why this is correct
Placing the new subscription under Prod-MG is correct because management group inheritance automatically applies the same Azure Policy, RBAC role assignments, and budget guardrails already configured for production workloads to this subscription without any extra setup. This is the standard pattern for centralized governance: as soon as the subscription is created under Prod-MG, it inherits the parent's controls, ensuring finance production resources comply with mandatory tagging, allowed regions, and cost limits from day one. The subscription also sits at the correct level in the hierarchy so that any future nested management groups or policy exemptions explicitly scoped to Prod-MG will behave as expected.
✗Place the subscription under Sandbox-MG.Wrong answer — click to see why▾
Why this is wrong here
The Sandbox-MG is designed for non-production workloads and does not apply the production governance baseline (e.g., policies, RBAC) that the question requires.
★ When this WOULD be the correct answer
If the question asked for a subscription that should NOT inherit production governance, such as for testing or development, placing it under Sandbox-MG would be correct.
Why candidates choose this
Candidates may confuse 'sandbox' with a general-purpose management group, or assume any management group automatically inherits all baselines, ignoring that governance is specific to each group.
✗Create a resource group named Finance-Prod instead of assigning a management group.Wrong answer — click to see why▾
Why this is wrong here
Creating a resource group does not enable inheritance of governance baselines like policies or RBAC from a management group; governance inheritance requires placing the subscription under a management group.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a way to organize resources within a subscription without inheriting management group policies, such as when deploying a project that needs custom policies not aligned with the production baseline.
Why candidates choose this
Candidates may confuse resource groups with management groups, thinking that creating a resource group under a management group achieves the same inheritance, or they may underestimate the role of management groups in policy inheritance.
✗Move the subscription to the tenant root and assign policies later.Wrong answer — click to see why▾
Why this is wrong here
Moving the subscription to the tenant root does not automatically inherit any governance baseline; it only places it at the top level without any management group hierarchy. The question requires automatic inheritance of the production governance baseline, which is achieved by placing the subscription under Prod-MG, not the tenant root.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the question asks for the best practice to avoid inheriting any existing policies or governance baselines, such as when setting up a completely isolated subscription for testing or a new environment that should not be affected by current management group policies.
Why candidates choose this
Candidates may think that placing a subscription at the tenant root is a neutral starting point that allows them to later assign policies manually, but they overlook that the question specifically requires automatic inheritance of an existing baseline, which the tenant root does not provide.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.