AZ-104 Manage Azure Identities and Governance Practice Question
An organization wants to enforce two governance controls on all subscriptions under a management group: only approved Azure regions can be used, and every resource must have a costCenter tag. Central IT wants one assignment that can grow as more controls are added later. What should they use?
⚠ Common exam trap
It's easy for candidates to confuse a single policy assignment with an initiative assignment, as candidates often think multiple rules can be added to one policy definition, but Azure Policy requires an initiative to combine separate policy definitions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An initiative assigned at the management group scope.
An initiative (policy set) allows grouping multiple policy definitions into a single assignment, which can be assigned at the management group scope to enforce both the allowed regions and costCenter tag requirements. This approach supports future growth by simply adding new policy definitions to the initiative without creating separate assignments. Assigning at the management group scope ensures the controls cascade to all child subscriptions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A single Azure Policy assignment that contains both requirements as separate policy rules.
Why it's wrong here
Although a single Azure Policy definition can contain multiple conditions in its policy rule, assigning that one definition via a single policy assignment is not the optimal structure for two distinct governance controls. Policy assignments support only one definition or initiative; packing unrelated requirements into a single definition couples their lifecycle, making it harder to remediate or track compliance per control. An initiative is the proper container because it lets each control remain an independent, versioned definition while being assigned jointly.
When this WOULD be correct
If the question asked for enforcing two controls with a single assignment and no future expansion needed, a policy assignment with multiple rules would be correct.
- ✓
An initiative assigned at the management group scope.
Why this is correct
An initiative assigned at the management group scope is the correct approach because an initiative groups multiple policy definitions under a single assignment, enabling reusable governance baselines. Assigning it at the management group scope applies both controls to every subscription beneath that management group, and because the subscription is in the scope, the policy definitions inherit down the hierarchy. This structure centralizes compliance enforcement, allows parameterization, and simplifies reporting across the entire enterprise without needing per-subscription assignments.
- ✗
A role assignment at the management group scope.
Why it's wrong here
A role assignment at the management group scope is unrelated to governance controls because Azure RBAC authorizes actions (who can manage what), not the configuration or compliance state of resources. Granting a role—even at management group scope—does not restrict resource deployment to certain regions or require tags; those are Azure Policy concerns. While role assignments are necessary for delegation, they cannot enforce 'must use' or 'must not use' rules because they do not evaluate resource attributes or emit compliance results.
When this WOULD be correct
A question asking how to grant a security team read-only access to all resources under a management group for auditing purposes would make a role assignment at the management group scope the correct answer.
- ✗
A resource lock applied to each subscription.
Why it's wrong here
A resource lock applied to each subscription is a common governance mistake because locks protect against accidental deletion or modification by that subscription's users—they do not evaluate or enforce requirements like allowed regions or required tags. Resource locks are an operational guardrail, not a compliance check: they block certain operations but do not provision, remediate, or audit resource configuration. Even if every subscription were locked, the two policy-driven controls still would not be enforced, so locks fail to address the core governance requirements.
When this WOULD be correct
A question asks: 'An organization wants to prevent accidental deletion of a critical resource group. What should they use?' Resource locks (e.g., CanNotDelete) would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An initiative assigned at the management group scope.Correct answer▾
Why this is correct
An initiative assigned at the management group scope is the correct approach because an initiative groups multiple policy definitions under a single assignment, enabling reusable governance baselines. Assigning it at the management group scope applies both controls to every subscription beneath that management group, and because the subscription is in the scope, the policy definitions inherit down the hierarchy. This structure centralizes compliance enforcement, allows parameterization, and simplifies reporting across the entire enterprise without needing per-subscription assignments.
✗A single Azure Policy assignment that contains both requirements as separate policy rules.Wrong answer — click to see why▾
Why this is wrong here
A single policy assignment with separate rules cannot be easily extended with new controls; initiatives (policy sets) are designed to group multiple policies for scalable governance.
★ When this WOULD be the correct answer
If the question asked for enforcing two controls with a single assignment and no future expansion needed, a policy assignment with multiple rules would be correct.
Why candidates choose this
Candidates may think a single policy assignment can bundle rules, overlooking that initiatives provide better manageability and scalability for adding controls later.
✗A role assignment at the management group scope.Wrong answer — click to see why▾
Why this is wrong here
Role assignments grant permissions to users or services, not enforce governance controls like allowed regions or required tags. They cannot enforce resource configuration or compliance.
★ When this WOULD be the correct answer
A question asking how to grant a security team read-only access to all resources under a management group for auditing purposes would make a role assignment at the management group scope the correct answer.
Why candidates choose this
Candidates may confuse role-based access control (RBAC) with Azure Policy, thinking that assigning a role can enforce rules, or they may assume that management group scope automatically applies governance.
✗A resource lock applied to each subscription.Wrong answer — click to see why▾
Why this is wrong here
Resource locks prevent accidental deletion or modification but cannot enforce allowed regions or required tags. They are not a governance control for compliance rules.
★ When this WOULD be the correct answer
A question asks: 'An organization wants to prevent accidental deletion of a critical resource group. What should they use?' Resource locks (e.g., CanNotDelete) would be correct.
Why candidates choose this
Candidates may confuse resource locks with policy enforcement, thinking locks can restrict resource creation or configuration, when they only protect existing resources from changes.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Initiative
An initiative is a formal, structured effort or project undertaken by an organization to achieve a specific strategic goal, often involving changes to IT systems, policies, or processes.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.