AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Cost reporting extract Resource name: vm-fin-01 | Resource group: rg-west-prod | Department: blank | Environment: Prod Resource name: sql-fin-01 | Resource group: rg-west-data | Department: blank | Environment: Prod Resource name: app-fin-01 | Resource group: rg-east-app | Department: blank | Environment: Test Requirement: Finance wants each resource to retain ownership metadata for reporting and chargeback, regardless of which resource group the resource is placed in later.
Based on the exhibit, which Azure feature should the administrator add so ownership and chargeback information remains visible even if resources are moved between resource groups?
⚠ Common exam trap
Candidates often confuse Resource locks (which prevent deletion) with metadata persistence, or assume Role assignments follow resources across moves, when in fact RBAC assignments are scoped to the original resource group and are lost upon relocation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tags
Tags are metadata key-value pairs that can be assigned to Azure resources and resource groups. They persist even when resources are moved between resource groups, making them ideal for tracking ownership and chargeback information across organizational boundaries. Unlike other options, tags are specifically designed for cost tracking, ownership attribution, and resource categorization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Management groups
Why it's wrong here
Management groups are containers that organize multiple Azure subscriptions into a hierarchy for applying enterprise-wide policies, RBAC roles, and budget guardrails via policy and initiative assignments. They operate at the subscription level and cannot store per-resource metadata such as an owner, environment, or cost center, so they don't help with individual resource chargeback or reporting. While management groups can indirectly influence costs via policies, they lack the granular, resource-specific tagging capability that the exhibit's scenario requires.
When this WOULD be correct
An administrator needs to apply consistent policies (e.g., allowed regions) and access control across multiple subscriptions, and wants to organize subscriptions into a hierarchy for governance. Management groups would be the correct feature to add.
- ✓
Tags
Why this is correct
Tags are key-value pairs you attach directly to Azure resources (or resource groups/subscriptions) to store flexible metadata such as department, environment, project, or cost center. These attributes make resources filterable, groupable, and reportable, so you can use Cost Management export and Azure Resource Graph to slice billing data by owner or team. Unlike security-oriented features, tags carry no permissions or protection—they exist purely for operational and chargeback context, which is exactly what the exhibit's requirement of ownership and reporting metadata calls for.
- ✗
Resource locks
Why it's wrong here
Resource locks (CanNotDelete and ReadOnly) are Azure design controls that prevent accidental deletion or modification by blocking management operations at the resource, resource group, or subscription scope. They don't carry any business context—no owner, department, or environment information—so they cannot support filtering or cost-allocation reporting. In fact, applying a lock purely to label ownership would be both ineffective and dangerous, because locks also require administrative effort to manage and can interfere with legitimate automation.
- ✗
Role assignments
Why it's wrong here
Role assignments are the mechanism Azure RBAC uses to grant identities (users, groups, service principals, or managed identities) a specific role, like Contributor or Reader, over a scope. They answer 'who can do what,' not 'what does this resource belong to,' so they contain no deployer, department, or chargeback metadata. Role assignments also create security boundaries and can include privilege escalation if misused, making them a poor fit for business-tagging needs.
When this WOULD be correct
A question asks: 'Which Azure feature should an administrator use to ensure that only authorized users can manage a critical resource, even if it is moved to another resource group?' In that scenario, role assignments would be correct because they define permissions that can be inherited or reassigned after a move.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓TagsCorrect answer▾
Why this is correct
Tags are key-value pairs you attach directly to Azure resources (or resource groups/subscriptions) to store flexible metadata such as department, environment, project, or cost center. These attributes make resources filterable, groupable, and reportable, so you can use Cost Management export and Azure Resource Graph to slice billing data by owner or team. Unlike security-oriented features, tags carry no permissions or protection—they exist purely for operational and chargeback context, which is exactly what the exhibit's requirement of ownership and reporting metadata calls for.
✗Management groupsWrong answer — click to see why▾
Why this is wrong here
Management groups provide hierarchical organization and policy inheritance across subscriptions, but they do not persist metadata like ownership or chargeback information when resources are moved between resource groups.
★ When this WOULD be the correct answer
An administrator needs to apply consistent policies (e.g., allowed regions) and access control across multiple subscriptions, and wants to organize subscriptions into a hierarchy for governance. Management groups would be the correct feature to add.
Why candidates choose this
Candidates may confuse management groups with a way to track ownership or cost, because they are used for organizing resources and applying policies at scale.
✗Role assignmentsWrong answer — click to see why▾
Why this is wrong here
Role assignments control access permissions but do not persist ownership or chargeback information when resources are moved between resource groups; they are tied to the resource scope and can change with moves.
★ When this WOULD be the correct answer
A question asks: 'Which Azure feature should an administrator use to ensure that only authorized users can manage a critical resource, even if it is moved to another resource group?' In that scenario, role assignments would be correct because they define permissions that can be inherited or reassigned after a move.
Why candidates choose this
Candidates may confuse role assignments with tracking ownership, as roles often define who can manage resources, but they do not carry metadata like cost center or owner tags across moves.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.