An organization wants to enforce two governance controls on all subscriptions under a management group: only approved Azure regions can be used, and every resource must have a costCenter tag. Central IT wants one assignment that can grow as more controls are added later. What should they use?

A single Azure Policy assignment that contains both requirements as separate policy rules.

A single policy assignment can attach one policy definition, but it is not the best structure for multiple controls.

A role assignment at the management group scope.

RBAC controls access, not compliance requirements such as allowed regions or required tags.

A resource lock applied to each subscription.

Locks prevent changes to resources but do not evaluate or enforce policy compliance rules.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: An initiative assigned at the management group scope. — An initiative is the right choice because it bundles multiple Azure Policy definitions into a single governance package. Assigning it at the management group scope ensures every current and future subscription beneath that management group inherits the same baseline. This design also makes it easier to expand the control set later without rebuilding the overall assignment structure or duplicating policy management across subscriptions. Why others are wrong: Option A is too limited as a long-term governance model because it does not provide the same reusable grouping structure as an initiative. Option C is unrelated because RBAC governs who can do what, not what configurations are allowed. Option D does not enforce policy rules and cannot report compliance in the same way.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.