How to Enforce Allowed Azure Regions Across Multiple Subscriptions Centrally
Your company wants to enforce a standard list of allowed Azure regions for all new resource deployments across several subscriptions. You need a centralized governance solution that can be assigned once and inherited by the child subscriptions. What should you use?
Quick Answer
The answer is an Azure Policy assigned at the management group scope. This is the correct centralized governance solution because management groups act as containers for organizing subscriptions, and any policy assigned at that level is automatically inherited by all child subscriptions, enforcing a standard list of allowed Azure regions without needing to configure each subscription individually. On the AZ-104 exam, this scenario tests your understanding of Azure Policy inheritance and management group hierarchy, often appearing as a trap where candidates mistakenly choose a policy assigned per subscription or a resource lock—remember, locks prevent deletion, not deployment restrictions. The key distinction is that management group scope provides the centralized enforcement you need for consistent compliance across multiple subscriptions. Memory tip: think "one policy at the top, enforced all the way down" to recall that management group inheritance is the backbone of centralized governance.
⚠ Common exam trap
Test-takers frequently confuse Azure Policy (which enforces rules on resource properties) with RBAC (which controls access permissions), leading candidates to incorrectly choose a custom RBAC role thinking it can restrict regions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An Azure Policy assigned at the management group scope
Azure Policy assigned at the management group scope is the correct centralized governance solution because it enforces a standard list of allowed Azure regions across all subscriptions under that management group. Policies at the management group level are inherited by all child subscriptions, ensuring consistent compliance without requiring individual assignment per subscription.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An Azure Policy assigned at the management group scope
Why this is correct
A management group policy assignment is inherited by child subscriptions and can restrict allowed locations centrally.
- ✗
A custom RBAC role assigned at each subscription
Why it's wrong here
RBAC controls permissions, not permitted deployment regions.
When this WOULD be correct
A custom RBAC role would be correct in a scenario where you need to grant specific permissions (e.g., 'Microsoft.Resources/subscriptions/resourceGroups/write') to a security principal across multiple subscriptions, and you want to define a custom set of actions not covered by built-in roles. The question would specify access control, not resource compliance.
- ✗
A CanNotDelete lock on each subscription
Why it's wrong here
Locks prevent deletion or modification, not regional deployment choices.
When this WOULD be correct
You need to prevent accidental deletion of critical resources across multiple subscriptions. A CanNotDelete lock applied at the management group scope would be inherited by all child subscriptions, protecting those resources from deletion.
- ✗
A budget alert on each subscription
Why it's wrong here
Budget alerts do not enforce deployment geography.
When this WOULD be correct
A question asking how to receive notifications when subscription spending exceeds a defined amount, without preventing deployments, would make budget alerts the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An Azure Policy assigned at the management group scopeCorrect answer▾
Why this is correct
A management group policy assignment is inherited by child subscriptions and can restrict allowed locations centrally.
✗A custom RBAC role assigned at each subscriptionWrong answer — click to see why▾
Why this is wrong here
A custom RBAC role assigned at each subscription cannot enforce a list of allowed Azure regions because RBAC controls access to resources, not the configuration or compliance of resource deployments. It would require assigning the role to every subscription individually, lacking centralized inheritance.
★ When this WOULD be the correct answer
A custom RBAC role would be correct in a scenario where you need to grant specific permissions (e.g., 'Microsoft.Resources/subscriptions/resourceGroups/write') to a security principal across multiple subscriptions, and you want to define a custom set of actions not covered by built-in roles. The question would specify access control, not resource compliance.
Why candidates choose this
Candidates may confuse RBAC with governance policies, thinking that restricting permissions to certain regions via a custom role would prevent deployments in disallowed regions, but RBAC does not filter allowed locations during resource creation.
✗A CanNotDelete lock on each subscriptionWrong answer — click to see why▾
Why this is wrong here
A CanNotDelete lock prevents resource deletion but does not restrict which Azure regions can be used for new deployments. It cannot enforce a list of allowed regions.
★ When this WOULD be the correct answer
You need to prevent accidental deletion of critical resources across multiple subscriptions. A CanNotDelete lock applied at the management group scope would be inherited by all child subscriptions, protecting those resources from deletion.
Why candidates choose this
Candidates may confuse locks with policies, thinking that a lock can restrict resource creation or configuration, when locks only affect deletion or modification operations.
✗A budget alert on each subscriptionWrong answer — click to see why▾
Why this is wrong here
Budget alerts only notify about spending thresholds; they do not enforce or restrict which Azure regions can be used for resource deployments.
★ When this WOULD be the correct answer
A question asking how to receive notifications when subscription spending exceeds a defined amount, without preventing deployments, would make budget alerts the correct answer.
Why candidates choose this
Candidates may confuse cost governance with resource governance, thinking that budget controls can also restrict region selection.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer already has permission to create resource groups. The company wants to allow deployments only in the East US and West US regions. Which service should enforce this rule?
easy- A.Azure RBAC, because region selection is part of user permissions.
- ✓ B.Azure Policy, because it can restrict which regions are allowed for deployments.
- C.A network security group, because it can block unsupported regions.
- D.A read-only lock, because it limits changes to approved regions.
Why B: Azure Policy is the correct service because it enforces organizational rules by evaluating resource configurations against policy definitions. In this scenario, a built-in or custom policy can restrict allowed regions for all resources, ensuring deployments only occur in East US and West US. Unlike RBAC, which controls who can perform actions, Azure Policy controls what resource configurations are permitted, making it the appropriate tool for region restriction.
Variation 2. A subscription already grants Contributor to an application team. The organization wants to prevent deployments in unsupported Azure regions and ensure every new resource has an Environment tag. Which two controls should be implemented with Azure Policy rather than RBAC? Select two.
hard- ✓ A.Assign an allowed-locations policy at the management group or subscription scope.
- B.Create a custom RBAC role that blocks resources deployed outside approved regions.
- ✓ C.Assign a policy that enforces the Environment tag on new resources.
- D.Add a CanNotDelete lock to every resource group.
- E.Grant User Access Administrator to the deployment team.
Why A: Azure Policy can enforce an 'allowed-locations' policy at the management group or subscription scope to restrict resource deployment to only approved Azure regions. This is a governance control that operates declaratively, evaluating resource properties against policy rules before or after creation, unlike RBAC which controls identity-based permissions. Option C is correct because Azure Policy can enforce the 'Environment' tag on new resources using a 'require a tag and its value' policy, ensuring compliance without modifying role assignments.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.