When to Use an Azure Policy Initiative Instead of a Single Policy Definition
Central IT wants to apply three related policy definitions—allowed Azure regions, required owner tag, and approved VM sizes—to all subscriptions in the Corp management group and report compliance as one package. What should the administrator create?
Quick Answer
The answer is an initiative, because when you need to apply multiple related policy definitions as a single compliance package across a management group, an Azure Policy initiative—also known as a policy set—is the correct construct. A single policy definition enforces one rule, but an initiative groups several definitions, like allowed regions, required tags, and approved VM sizes, so they are assigned and reported together. On the AZ-104 exam, this scenario tests your understanding of policy grouping for centralized governance, often appearing as a trap where candidates mistakenly choose individual policy assignments, which would require separate compliance tracking. Remember the key distinction: use a single definition for one rule, but use an initiative when the business requirement demands a bundled, collective compliance report. A helpful memory tip is to think of an initiative as a “policy playlist”—just as a playlist groups songs for one listening session, an initiative groups policies for one compliance view.
⚠ Common exam trap
Many exam-takers confuse a single policy definition with a policy initiative, or think that a resource lock or role assignment can enforce governance rules, when only an initiative can group multiple policies and report compliance as one package.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An initiative
An initiative (also known as a policy set) in Azure Policy allows you to group multiple related policy definitions into a single package. By assigning the initiative to the Corp management group, all subscriptions under that management group inherit the three policies (allowed regions, required owner tag, approved VM sizes) as a bundle, and compliance is reported collectively for the entire initiative.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An initiative
Why this is correct
An initiative groups multiple policy definitions into a single assignment and provides one compliance view for the set. That matches the requirement to apply several related governance controls together across the management group without managing each policy separately.
- ✗
A resource lock
Why it's wrong here
A lock prevents deletion or can restrict writes, but it does not bundle policies or report compliance together.
When this WOULD be correct
An administrator needs to prevent accidental deletion of a critical resource group containing production virtual machines. They should create a CanNotDelete resource lock on that resource group.
- ✗
A role assignment
Why it's wrong here
RBAC grants permissions to users or identities and has nothing to do with policy aggregation or compliance reporting.
When this WOULD be correct
An administrator needs to grant a user the 'Contributor' role on a specific resource group so they can manage resources within it. In that scenario, creating a role assignment is the correct action.
- ✗
A managed identity
Why it's wrong here
A managed identity helps authenticate workloads, but it does not define governance rules or policy compliance.
When this WOULD be correct
An administrator needs to assign permissions to a virtual machine so it can access Azure Key Vault secrets without storing credentials. A managed identity would be the correct solution to authenticate the VM to Key Vault.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An initiativeCorrect answer▾
Why this is correct
An initiative groups multiple policy definitions into a single assignment and provides one compliance view for the set. That matches the requirement to apply several related governance controls together across the management group without managing each policy separately.
✗A resource lockWrong answer — click to see why▾
Why this is wrong here
A resource lock prevents deletion or modification of resources but cannot group and assign multiple policy definitions across subscriptions for compliance reporting.
★ When this WOULD be the correct answer
An administrator needs to prevent accidental deletion of a critical resource group containing production virtual machines. They should create a CanNotDelete resource lock on that resource group.
Why candidates choose this
Candidates may confuse resource locks with policy assignments, thinking locks can enforce rules like allowed regions or tags, but locks only protect against deletion/modification, not compliance enforcement.
✗A role assignmentWrong answer — click to see why▾
Why this is wrong here
A role assignment grants permissions to an identity, not a collection of policy definitions. The question requires grouping policies into a single compliance package, which is achieved by an initiative, not a role assignment.
★ When this WOULD be the correct answer
An administrator needs to grant a user the 'Contributor' role on a specific resource group so they can manage resources within it. In that scenario, creating a role assignment is the correct action.
Why candidates choose this
Candidates may confuse policy assignment (assigning an initiative) with role assignment, or think that applying policies requires granting permissions to an identity.
✗A managed identityWrong answer — click to see why▾
Why this is wrong here
A managed identity is an Azure Active Directory identity for authenticating to Azure services, not for grouping policy definitions. It cannot bundle multiple policies into a single compliance package.
★ When this WOULD be the correct answer
An administrator needs to assign permissions to a virtual machine so it can access Azure Key Vault secrets without storing credentials. A managed identity would be the correct solution to authenticate the VM to Key Vault.
Why candidates choose this
Candidates may confuse 'managed' with 'management' or think that a managed identity can 'manage' policies, or they may associate it with governance without understanding its actual authentication purpose.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A compliance team wants to bundle three policy definitions—allowed locations, required cost center tags, and approved VM sizes—so they can assign them together to a management group and review compliance in one place. Later they want to exempt one pilot subscription from the entire set for 60 days. What should they use?
hard- ✓ A.A policy initiative at the management group scope.
- B.A custom RBAC role with resource permissions for policy management.
- C.A resource lock on the pilot subscription.
- D.A separate management group for each of the three policy definitions.
Why A: A policy initiative (also called a policy set) allows you to group multiple policy definitions into a single, reusable bundle. By assigning the initiative at the management group scope, all three policies apply together to every subscription under that group. When the pilot subscription needs an exemption, you can create an exemption resource on that subscription for the entire initiative, specifying a 60-day expiration, which temporarily excludes it from all bundled policies while keeping compliance reporting unified.
Variation 2. You need one assignment that requires a cost-center tag and also allows only approved locations. What should you use?
easy- ✓ A.A policy initiative
- B.A role assignment
- C.A resource lock
- D.A management group
Why A: A policy initiative is the correct choice because it allows you to group multiple Azure Policy definitions (such as 'Require a cost-center tag' and 'Allowed locations') into a single, reusable assignment. This ensures both conditions are enforced simultaneously at a scope like a subscription or resource group, meeting the requirement for a cost-center tag and location restriction.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.