AZ-104 Manage Azure Identities and Governance Practice Question
An enterprise wants to enforce three governance controls for all subscriptions under a management group: allowed locations, required tags, and permitted VM sizes. The team wants a single place to assign and track compliance for all three controls. What should the administrator use?
⚠ Common exam trap
It's easy for candidates to confuse Azure Policy (which enforces rules on resource properties) with RBAC (which controls access permissions) or resource locks (which prevent deletion), leading candidates to pick a solution that addresses a different concern than governance compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
One policy initiative assigned at the management group
A policy initiative (also known as a policy set) allows you to group multiple policy definitions (e.g., allowed locations, required tags, permitted VM sizes) into a single, reusable package. Assigning this initiative at the management group level enforces all three governance controls across every subscription under that management group, providing a single place to assign and track compliance via Azure Policy's compliance dashboard.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Three separate policy assignments at each subscription
Why it's wrong here
Creating three separate policy assignments at each subscription results in duplicated effort and inconsistent configuration if any assignment is altered per subscription. It also fragments governance monitoring, as each subscription has its own set of assignments, making it harder to audit and remediate compliance across the enterprise. While technically functional, this approach does not provide a consolidated, scalable control package.
When this WOULD be correct
If the question specified that different subscriptions require different allowed locations or VM sizes, and the team needs granular control per subscription rather than a uniform set of policies across all subscriptions, then separate policy assignments at each subscription would be appropriate.
- ✓
One policy initiative assigned at the management group
Why this is correct
An Azure Policy initiative bundles multiple related policies into a single package; assigning the initiative at the management group scope applies it to every child subscription and resource group beneath it. This approach centralizes governance enforcement, ensures consistent compliance across all subscriptions, and simplifies reporting because all policies are evaluated together under one assignment.
- ✗
A custom RBAC role assigned to each subscription
Why it's wrong here
A custom RBAC role controls what principals can do, such as reading, writing, or deleting resources, but it cannot enforce governance rules like allowed locations or required tags. RBAC roles are granted to users, groups, or service principals, and they do not evaluate or report on resource configuration. Therefore, a custom role cannot enforce compliance controls across subscriptions.
When this WOULD be correct
An administrator needs to grant a specific set of permissions (e.g., read-only access to VMs but full access to storage) to all subscriptions under a management group, and the built-in roles do not provide the exact combination. A custom RBAC role assigned at the management group would be correct.
- ✗
A resource lock on each subscription
Why it's wrong here
A resource lock, such as CanNotDelete or ReadOnly, protects resources from accidental deletion or modification, but it does not assess or enforce policy compliance like allowed locations or tag requirements. Locks are meant to prevent unauthorized operations, not to evaluate whether resources meet governance rules. Additionally, locks apply to specific resources or resource groups, not to an entire subscription’s compliance posture.
When this WOULD be correct
An administrator needs to prevent accidental deletion or modification of critical subscriptions, such as production subscriptions, to ensure they are not removed or changed without authorization. A resource lock (e.g., CanNotDelete) would be the correct solution.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓One policy initiative assigned at the management groupCorrect answer▾
Why this is correct
An Azure Policy initiative bundles multiple related policies into a single package; assigning the initiative at the management group scope applies it to every child subscription and resource group beneath it. This approach centralizes governance enforcement, ensures consistent compliance across all subscriptions, and simplifies reporting because all policies are evaluated together under one assignment.
✗Three separate policy assignments at each subscriptionWrong answer — click to see why▾
Why this is wrong here
Three separate policy assignments at each subscription would require managing each subscription individually, violating the requirement for a single place to assign and track compliance across all subscriptions under the management group.
★ When this WOULD be the correct answer
If the question specified that different subscriptions require different allowed locations or VM sizes, and the team needs granular control per subscription rather than a uniform set of policies across all subscriptions, then separate policy assignments at each subscription would be appropriate.
Why candidates choose this
Candidates may think that assigning policies per subscription is the only way to enforce controls, not realizing that a policy initiative at the management group can apply to all child subscriptions uniformly and be tracked centrally.
✗A custom RBAC role assigned to each subscriptionWrong answer — click to see why▾
Why this is wrong here
Custom RBAC roles control permissions to Azure resources, not governance policies like allowed locations, required tags, or permitted VM sizes. These controls require Azure Policy, not role-based access control.
★ When this WOULD be the correct answer
An administrator needs to grant a specific set of permissions (e.g., read-only access to VMs but full access to storage) to all subscriptions under a management group, and the built-in roles do not provide the exact combination. A custom RBAC role assigned at the management group would be correct.
Why candidates choose this
Candidates may confuse governance controls with access control, thinking that restricting permissions can enforce location or tag requirements, or they may mistakenly believe RBAC can enforce resource configuration policies.
✗A resource lock on each subscriptionWrong answer — click to see why▾
Why this is wrong here
Resource locks prevent accidental deletion or modification of resources but do not enforce governance controls like allowed locations, required tags, or permitted VM sizes. They cannot track compliance across multiple policies.
★ When this WOULD be the correct answer
An administrator needs to prevent accidental deletion or modification of critical subscriptions, such as production subscriptions, to ensure they are not removed or changed without authorization. A resource lock (e.g., CanNotDelete) would be the correct solution.
Why candidates choose this
Candidates may confuse resource locks with governance controls, thinking that locking a subscription can enforce policies, or they may overestimate the scope of locks as a management tool.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Initiative
An initiative is a formal, structured effort or project undertaken by an organization to achieve a specific strategic goal, often involving changes to IT systems, policies, or processes.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization wants to enforce two governance controls on all subscriptions under a management group: only approved Azure regions can be used, and every resource must have a costCenter tag. Central IT wants one assignment that can grow as more controls are added later. What should they use?
medium- A.A single Azure Policy assignment that contains both requirements as separate policy rules.
- ✓ B.An initiative assigned at the management group scope.
- C.A role assignment at the management group scope.
- D.A resource lock applied to each subscription.
Why B: An initiative (policy set) allows grouping multiple policy definitions into a single assignment, which can be assigned at the management group scope to enforce both the allowed regions and costCenter tag requirements. This approach supports future growth by simply adding new policy definitions to the initiative without creating separate assignments. Assigning at the management group scope ensures the controls cascade to all child subscriptions.
Variation 2. A department has 12 subscriptions under a management group named Corp. New resources must be deployed only in East US or West US and must include a CostCenter tag. A pilot subscription must be exempt from these rules during testing. Which two actions should you take? Select two.
hard- ✓ A.Assign an initiative containing both policy definitions at the Corp management-group scope.
- ✓ B.Create a policy exemption for the pilot subscription.
- C.Assign the policies individually at each resource group.
- D.Use the Owner role at the management-group scope.
- E.Use a resource lock instead of Azure Policy.
Why A: Assigning an initiative (a collection of policy definitions) at the Corp management-group scope ensures that all 12 subscriptions inherit both the location restriction and the CostCenter tag requirement. This is the most efficient and scalable way to enforce governance across multiple subscriptions without repeating assignments.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.