AZ-104 Manage Azure Identities and Governance Practice Question
A company wants to enforce three controls across all current and future subscriptions under a management group: allowed Azure regions, a required cost center tag, and approved VM SKUs. Central IT wants a single assignment and consolidated compliance reporting. What should they use?
⚠ Common exam trap
Test-takers frequently confuse resource locks or RBAC with policy-based governance, thinking they can enforce allowed configurations through access control or locks, but only Azure Policy (via initiatives) can evaluate and enforce resource properties like regions, tags, and SKUs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
One initiative assignment at the management group scope.
An initiative (policy set) at the management group scope allows you to bundle multiple policy definitions (allowed regions, required tag, approved VM SKUs) into a single assignment. This ensures the controls apply to all current and future subscriptions under that management group, and Azure Policy provides consolidated compliance reporting at the management group level, meeting the requirement for a single assignment and unified view.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Three separate policy assignments at each subscription scope.
Why it's wrong here
Assigning three separate policies at each subscription scope fails to provide centralized governance because every subscription must be manually configured, and any newly created subscription is left without the assignments until someone remembers to add them. This approach fragments compliance reporting into per-subscription states, making it hard to see an aggregated, organization-wide view, and increases the risk of inconsistent parameters or missed assignments. A management group-level initiative assignment automatically covers all existing and future child subscriptions in one operation.
When this WOULD be correct
If the requirement was to apply different policies to each subscription individually (e.g., different allowed regions per subscription), and there was no need for consolidated reporting, then separate assignments at each subscription scope would be appropriate.
- ✓
One initiative assignment at the management group scope.
Why this is correct
An initiative groups multiple related policies into one assignable unit. Assigning it at the management group scope ensures the controls apply to all current and future subscriptions beneath it, while keeping compliance reporting centralized and easier to manage.
- ✗
A resource lock on the management group to prevent noncompliant deployments.
Why it's wrong here
A resource lock (CanNotDelete or ReadOnly) only prevents accidental deletion or modification of resources; it does not inspect or validate resource properties against compliance requirements. Locking a management group cannot block a deployment that creates a resource with a disallowed location, missing tag, or nonapproved SKU because locks are not policy engines and have no awareness of desired configuration. Additionally, resource locks apply to resource lifecycle operations, not to the evaluation of new deployments for policy compliance.
When this WOULD be correct
An exam question where the requirement is to prevent accidental deletion or modification of a management group or its subscriptions, such as 'Prevent all users from deleting the management group hierarchy.'
- ✗
A custom RBAC role assigned to the management group.
Why it's wrong here
A custom RBAC role at the management group scope authorizes principals to perform actions, such as 'Microsoft.Resources/deployments/write', but it does not evaluate whether the deployed resource meets policy rules like allowed locations, required tags, or SKU constraints. RBAC is an identity and access management mechanism; even a user with full contributor rights can deploy a noncompliant resource unless Azure Policy is separately assigned to audit or deny it. Custom roles also require maintaining role definitions and cannot enforce resource configuration compliance.
When this WOULD be correct
When a company needs to delegate specific management permissions (e.g., 'Virtual Machine Contributor' with restricted scope) to a team for all subscriptions under a management group, a custom RBAC role assigned at the management group scope would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓One initiative assignment at the management group scope.Correct answer▾
Why this is correct
An initiative groups multiple related policies into one assignable unit. Assigning it at the management group scope ensures the controls apply to all current and future subscriptions beneath it, while keeping compliance reporting centralized and easier to manage.
✗Three separate policy assignments at each subscription scope.Wrong answer — click to see why▾
Why this is wrong here
Three separate policy assignments at each subscription scope would require managing multiple assignments per subscription, contradicting the requirement for a single assignment and consolidated compliance reporting across all subscriptions under the management group.
★ When this WOULD be the correct answer
If the requirement was to apply different policies to each subscription individually (e.g., different allowed regions per subscription), and there was no need for consolidated reporting, then separate assignments at each subscription scope would be appropriate.
Why candidates choose this
Candidates may think that assigning policies directly to subscriptions gives more granular control, but they overlook the management group scope's ability to apply policies consistently across all subscriptions with a single assignment.
✗A resource lock on the management group to prevent noncompliant deployments.Wrong answer — click to see why▾
Why this is wrong here
A resource lock prevents deletion or modification of resources but does not enforce compliance policies like allowed regions, tags, or VM SKUs. It cannot provide consolidated compliance reporting.
★ When this WOULD be the correct answer
An exam question where the requirement is to prevent accidental deletion or modification of a management group or its subscriptions, such as 'Prevent all users from deleting the management group hierarchy.'
Why candidates choose this
Candidates may confuse resource locks with policy enforcement, thinking a lock can restrict resource creation or configuration, or they may believe a management group lock applies policies to child subscriptions.
✗A custom RBAC role assigned to the management group.Wrong answer — click to see why▾
Why this is wrong here
Custom RBAC roles control permissions to Azure resources, not compliance policies like allowed regions, tags, or VM SKUs. They cannot enforce or audit configuration requirements across subscriptions.
★ When this WOULD be the correct answer
When a company needs to delegate specific management permissions (e.g., 'Virtual Machine Contributor' with restricted scope) to a team for all subscriptions under a management group, a custom RBAC role assigned at the management group scope would be correct.
Why candidates choose this
Candidates may confuse RBAC with policy, thinking that restricting permissions can enforce compliance rules, or they may overestimate RBAC's ability to control resource configurations beyond access.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
Initiative
An initiative is a formal, structured effort or project undertaken by an organization to achieve a specific strategic goal, often involving changes to IT systems, policies, or processes.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.