Central IT wants to apply three related policy definitions—allowed Azure regions, required owner tag, and approved VM sizes—to all subscriptions in the Corp management group and report compliance as one package. What should the administrator create?

A role assignment

RBAC grants permissions to users or identities and has nothing to do with policy aggregation or compliance reporting.

A managed identity

A managed identity helps authenticate workloads, but it does not define governance rules or policy compliance.

A resource lock

A lock prevents deletion or can restrict writes, but it does not bundle policies or report compliance together.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: An initiative — An initiative is the Azure Policy construct used to package several policy definitions into one deployable unit. It fits when IT wants one assignment that enforces multiple governance controls, such as allowed regions, tags, and VM size restrictions, across a management group. Compliance reporting is also easier because the environment can be assessed as a single policy set instead of separate individual assignments. Why others are wrong: A lock only affects resource modification and deletion, not governance rule bundles. A role assignment provides access, not policy enforcement. A managed identity is an authentication feature and is unrelated to policy management or compliance reporting.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.