An enterprise wants to enforce three governance controls for all subscriptions under a management group: allowed locations, required tags, and permitted VM sizes. The team wants a single place to assign and track compliance for all three controls. What should the administrator use?

Three separate policy assignments at each subscription

This creates multiple management points and does not provide one consolidated control package.

A custom RBAC role assigned to each subscription

RBAC controls access, not compliance rules such as allowed locations or required tags.

A resource lock on each subscription

Locks prevent certain operations but do not evaluate or report policy compliance.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: One policy initiative assigned at the management group — A policy initiative is the right choice when multiple related Azure Policy definitions must be managed together. It simplifies assignment by grouping controls such as allowed locations, tag requirements, and SKU restrictions into one package. Assigning the initiative at the management group applies it to all current and future subscriptions beneath that scope, while compliance reporting stays centralized. That gives the organization one governance entry point and one reporting view. Why others are wrong: Separate subscription-level assignments increase administrative overhead and make compliance reporting harder to manage consistently. RBAC roles are about who can do what, not whether resources meet governance rules. Resource locks do not evaluate policy settings or produce compliance results. The initiative at management group scope is the only option that bundles the controls and enforces them across all child subscriptions.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.