AZ-104 Manage Azure Identities and Governance Practice Question
You need to ensure that all newly created resource groups in a subscription automatically inherit the CostCenter tag with a fixed value, even if the creator forgets to add it. Which Azure Policy effect should you use?
⚠ Common exam trap
Test-takers frequently choose Deny thinking it enforces compliance by blocking non-tagged resources, but they overlook that the question requires automatic inheritance, not rejection, making Modify the only effect that actively adds the missing tag.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify
The Modify effect is correct because it allows Azure Policy to automatically add or alter tags on resources or resource groups during creation or update, ensuring the CostCenter tag with a fixed value is applied even if the creator omits it. Unlike Audit or Deny, Modify actively remediates non-compliant resources by appending the required tag, making it ideal for enforcing mandatory inheritance without blocking deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Audit
Why it's wrong here
Audit is incorrect because it only generates an activity log entry and compliance report indicating that a resource group lacks the required tag, but it never changes the resource itself. This 'watch and report' behavior leaves the tag absent, so the resource group remains non-compliant unless an external process (like an Azure Automation runbook) later applies the fix. It also does not prevent future non-compliant resource groups from being created, since the default effect only warns rather than acts.
When this WOULD be correct
Use Audit when you need to evaluate compliance of existing resources against a policy (e.g., tag existence) without modifying them, such as for reporting or before enforcing a Deny effect.
- ✗
Deny
Why it's wrong here
Deny is not appropriate because it blocks the creation of any resource group that doesn't already specify the required tag, preventing the deployment entirely rather than adding the tag automatically. This can cause operational disruption and user errors, as legitimate resource group creation requests would fail if the tag is omitted, whereas the requirement is to ensure the tag is present, not to stop creation. Deny also cannot correct existing non-compliant resource groups, only protect new ones, and it doesn't offer any automatic remediation.
When this WOULD be correct
Use Deny when the requirement is to block any resource group creation that does not include a specific tag (e.g., CostCenter) at creation time, forcing the creator to provide it.
- ✓
Modify
Why this is correct
The Modify effect is the correct choice because it actively corrects non-compliant resources by automatically adding or updating the required tag on any new resource group during deployment. It uses a managed identity and remediation tasks to apply the tag idempotently, ensuring all future resource groups are compliant without blocking their creation. Unlike Deny, it doesn't impede operations, and unlike Audit, it doesn't merely report noncompliance.
- ✗
Disabled
Why it's wrong here
Disabled is wrong because it completely turns off the policy definition's evaluation and enforcement features, so Azure Policy will neither check for the tag nor report or correct anything. With the Disabled effect, the policy has no impact, making it equivalent to not having assigned the policy at all, which obviously fails the goal of ensuring all new resource groups have the required tag.
When this WOULD be correct
A policy with the 'Disabled' effect would be correct when you want to temporarily deactivate a policy without deleting it, for example during maintenance or testing, while retaining its definition for future use.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓ModifyCorrect answer▾
Why this is correct
The Modify effect is the correct choice because it actively corrects non-compliant resources by automatically adding or updating the required tag on any new resource group during deployment. It uses a managed identity and remediation tasks to apply the tag idempotently, ensuring all future resource groups are compliant without blocking their creation. Unlike Deny, it doesn't impede operations, and unlike Audit, it doesn't merely report noncompliance.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs non-compliance but does not automatically add the missing tag, so newly created resource groups would not inherit the CostCenter tag.
★ When this WOULD be the correct answer
Use Audit when you need to evaluate compliance of existing resources against a policy (e.g., tag existence) without modifying them, such as for reporting or before enforcing a Deny effect.
Why candidates choose this
Candidates may think Audit is sufficient for tracking compliance, but they overlook the requirement to automatically add the tag, which requires a Modify effect.
✗DenyWrong answer — click to see why▾
Why this is wrong here
Deny prevents creation of resources that don't meet a condition, but it cannot automatically add a missing tag; it would block the resource group creation entirely if the tag is missing, which is not the requirement.
★ When this WOULD be the correct answer
Use Deny when the requirement is to block any resource group creation that does not include a specific tag (e.g., CostCenter) at creation time, forcing the creator to provide it.
Why candidates choose this
Candidates may think Deny enforces tagging by rejecting non-compliant resources, but they overlook that the question asks for automatic inheritance, not rejection.
✗DisabledWrong answer — click to see why▾
Why this is wrong here
The 'Disabled' effect turns off the policy and does not enforce any behavior, so it cannot ensure that the CostCenter tag is automatically inherited on new resource groups.
★ When this WOULD be the correct answer
A policy with the 'Disabled' effect would be correct when you want to temporarily deactivate a policy without deleting it, for example during maintenance or testing, while retaining its definition for future use.
Why candidates choose this
Candidates might select 'Disabled' if they misinterpret the question as asking for a way to prevent the policy from interfering, or if they confuse 'Disabled' with a state where the policy is inactive but still defined.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.