AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Policy set draft Name: Dept-Guardrails Included rules: - Allowed locations: East US, West US - Require tag: CostCenter - Deny public IP creation on virtual machines Requirement: The same three controls must be assigned together to all subscriptions in the department, and the department wants one object to manage instead of three separate assignments.
Based on the exhibit, which Azure Policy construct should the administrator use to deploy and manage these guardrails as one unit across the department?
⚠ Common exam trap
Many exam-takers confuse Azure Policy initiatives with RBAC roles or resource locks, as candidates often think access control or resource protection alone can enforce governance guardrails, but only policy initiatives provide the unified, rule-based deployment and management of compliance requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Azure Policy initiative and assign it at the management group scope.
An Azure Policy initiative is a collection of policy definitions designed to group related policies together for deployment as a single unit. By assigning the initiative at the management group scope, the administrator can enforce consistent guardrails across all subscriptions within that management group, ensuring centralized governance and compliance for the entire department.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an Azure Policy initiative and assign it at the management group scope.
Why this is correct
An Azure Policy initiative (also known as a policySetDefinition) aggregates multiple related policy definitions into a single assignable unit. By assigning the initiative at the management group scope, you propagate the enforcement and compliance evaluation to every subscription and resource group within that hierarchy, ensuring consistent application of tag requirements, allowed locations, and other guardrails across a large enterprise without per-subscription assignments.
- ✗
Create an Azure RBAC role assignment at the management group scope.
Why it's wrong here
An Azure RBAC role assignment at the management group scope grants or denies users, groups, or service principals the ability to perform specific actions across child resources; it governs identity authorization, not resource configuration. RBAC cannot evaluate whether a resource adheres to organizational standards like location restrictions or tagging, because RBAC is concerned with 'who can do what' rather than 'what is allowed to exist'—so it cannot enforce compliance rules.
When this WOULD be correct
If the question were: 'Which construct should an administrator use to grant a team of developers contributor permissions to all subscriptions in a department?' then creating an RBAC role assignment at the management group scope would be correct.
- ✗
Apply a ReadOnly lock to each subscription.
Why it's wrong here
A ReadOnly lock at the subscription scope is a management-plane control that prevents users from creating, deleting, or modifying Azure resources—it does not evaluate resource properties against compliance rules. While a lock can block destructive actions, it cannot detect or remediate noncompliant configurations such as resources deployed in disallowed regions or missing required tags, so it is not a substitute for Azure Policy.
When this WOULD be correct
An administrator needs to prevent accidental deletion or modification of all resources in a subscription for a critical production environment, and the requirement is to enforce a read-only state across the entire subscription without implementing custom policies.
- ✗
Move all resources into one resource group.
Why it's wrong here
Consolidating all resources into a single resource group does not create a mechanism to evaluate or enforce policy conditions; resource groups are logical containers for management, cost, and lifecycle, not compliance engines. Even if everything resides in one group, Azure Policy still requires explicit policy definitions and assignments to check tag values or allowed locations, and this approach would hinder granularity and make applying different policies to different environments unnecessarily complicated.
When this WOULD be correct
An exam question asks: 'An administrator needs to simplify cost tracking by grouping all resources for a project under a single billing scope. Which action should be taken?' In that case, moving resources into one resource group would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create an Azure Policy initiative and assign it at the management group scope.Correct answer▾
Why this is correct
An Azure Policy initiative (also known as a policySetDefinition) aggregates multiple related policy definitions into a single assignable unit. By assigning the initiative at the management group scope, you propagate the enforcement and compliance evaluation to every subscription and resource group within that hierarchy, ensuring consistent application of tag requirements, allowed locations, and other guardrails across a large enterprise without per-subscription assignments.
✗Create an Azure RBAC role assignment at the management group scope.Wrong answer — click to see why▾
Why this is wrong here
Azure RBAC role assignments manage permissions for users/groups, not guardrails like policies. The question asks for deploying and managing guardrails (policy rules) as a unit, which requires an initiative, not RBAC.
★ When this WOULD be the correct answer
If the question were: 'Which construct should an administrator use to grant a team of developers contributor permissions to all subscriptions in a department?' then creating an RBAC role assignment at the management group scope would be correct.
Why candidates choose this
Candidates may confuse RBAC with policy because both involve 'assignments' at management group scope, and they might think role assignments can enforce rules like guardrails.
✗Apply a ReadOnly lock to each subscription.Wrong answer — click to see why▾
Why this is wrong here
Applying a ReadOnly lock to each subscription prevents accidental deletion or modification of resources but does not deploy or manage guardrails (policies) as a unit; it is a separate control mechanism, not a policy construct.
★ When this WOULD be the correct answer
An administrator needs to prevent accidental deletion or modification of all resources in a subscription for a critical production environment, and the requirement is to enforce a read-only state across the entire subscription without implementing custom policies.
Why candidates choose this
Candidates may confuse locks with policy guardrails because both are used to enforce compliance and prevent changes, but locks are a simpler, non-policy-based control.
✗Move all resources into one resource group.Wrong answer — click to see why▾
Why this is wrong here
Moving all resources into one resource group does not deploy or manage guardrails as a unit; it only consolidates resources without enforcing any policies or compliance rules.
★ When this WOULD be the correct answer
An exam question asks: 'An administrator needs to simplify cost tracking by grouping all resources for a project under a single billing scope. Which action should be taken?' In that case, moving resources into one resource group would be correct.
Why candidates choose this
Candidates may think that grouping resources together simplifies management and policy enforcement, but resource groups do not provide policy enforcement capabilities.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.