Azure Policy Modify Effect: Automatically Add Tags Without Blocking Deployments
Finance wants every resource created in one production resource group to receive the tag CostCenter=FINSVC automatically, but deployments should not be blocked if a template omits the tag. Existing resources should be updated when possible. Which two actions should the administrator take? Select two.
Quick Answer
The answer is to create a policy with the Modify effect and then run a remediation task for noncompliant existing resources. This is correct because the Modify effect automatically adds or updates the CostCenter tag during resource creation or update without blocking the deployment, unlike the Deny effect which would reject the request entirely. For existing resources that are already noncompliant, a remediation task is required to apply the tag retroactively, as the Modify effect only triggers on new or updated resources. On the AZ-104 exam, this scenario tests your understanding of policy effects and the distinction between preventing noncompliant resources (Deny) versus correcting them (Modify), a common trap where students mistakenly choose Deny. Remember the memory tip: “Modify to comply, remediate to apply”—the Modify effect handles new deployments automatically, while remediation fixes what’s already there.
⚠ Common exam trap
Test-takers frequently confuse Audit and Modify effects, thinking Audit can automatically fix tags, or they mistakenly believe a ReadOnly lock is needed to enforce consistency, when in fact Modify with remediation is the correct approach for automatic tag application without blocking deployments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign a Modify policy that adds or updates the CostCenter tag.
Option A is correct because an Azure Policy with the Modify effect can automatically add or update the CostCenter=FINSVC tag on resources created in the production resource group, and its remediation capability allows existing resources to be brought into compliance without blocking deployments. Option B is correct because after assigning a Modify policy, a remediation task is required to apply the tag to existing noncompliant resources, satisfying the requirement to update existing resources when possible. Option C is incorrect because a ReadOnly lock prevents modifications, including tag updates, and does not enforce tagging. Option D is incorrect because Reader only grants read access and has no effect on tag creation or enforcement. Option E is incorrect because an Audit policy only reports noncompliance and does not automatically add the tag or update existing resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign a Modify policy that adds or updates the CostCenter tag.
Why this is correct
A Modify policy with an addOrUpdate effect appends or overwrites the CostCenter tag during create and update operations, so resources receive CostCenter=FINSVC automatically without blocking deployments that omit the tag. This matches the requirement for automatic tagging without denial.
- ✓
Run a remediation task for noncompliant existing resources.
Why this is correct
A remediation task brings existing noncompliant resources into compliance with the Modify policy's tag definition, updating resources already deployed before the policy existed. This satisfies the stem's requirement that existing resources be updated where possible.
- ✗
Apply a ReadOnly lock to the resource group to keep tags consistent.
Why it's wrong here
A ReadOnly lock prevents modification of the resource group and its resources, blocking the tag writes the policy performs. Locks are correct when protecting production resources from accidental deletion or change, not for enforcing tag values.
When this WOULD be correct
A ReadOnly lock would be correct if the requirement was to prevent any changes to resources in the resource group, such as protecting critical production resources from accidental deletion or modification, and no tag automation was needed.
- ✗
Assign Reader to the resource group to ensure tag visibility.
Why it's wrong here
Reader grants read access to resources; it neither creates nor modifies tags, so it cannot apply CostCenter=FINSVC automatically or update existing resources. It is tempting because Reader is the standard role for auditing tag visibility, and would suit a scenario where staff must view tags without changing them.
When this WOULD be correct
This option would be correct if the question asked: 'Management wants all team members to be able to view tags on resources in a resource group, but not modify them. Which role should be assigned?'
- ✗
Use only an Audit policy so teams can see missing tags.
Why it's wrong here
Audit reports noncompliance but does not correct it. The scenario specifically requires automatic tagging when possible.
When this WOULD be correct
This option would be correct if the question asked for a solution that only monitors tag compliance without automatically applying tags, and the organization wants to manually enforce tagging through reports.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign a Modify policy that adds or updates the CostCenter tag.Correct answer▾
Why this is correct
A Modify policy with an addOrUpdate effect appends or overwrites the CostCenter tag during create and update operations, so resources receive CostCenter=FINSVC automatically without blocking deployments that omit the tag. This matches the requirement for automatic tagging without denial.
✗Apply a ReadOnly lock to the resource group to keep tags consistent.Wrong answer — click to see why▾
Why this is wrong here
Applying a ReadOnly lock prevents any modifications to resources, including adding or updating tags, which contradicts the requirement to automatically apply tags to new resources and update existing ones.
★ When this WOULD be the correct answer
A ReadOnly lock would be correct if the requirement was to prevent any changes to resources in the resource group, such as protecting critical production resources from accidental deletion or modification, and no tag automation was needed.
Why candidates choose this
Candidates may think a lock ensures consistency by preventing changes, but they overlook that it also blocks the automatic tag application and remediation needed to meet the requirement.
✗Assign Reader to the resource group to ensure tag visibility.Wrong answer — click to see why▾
Why this is wrong here
Assigning the Reader role to the resource group ensures tag visibility but does not automatically apply or enforce the CostCenter tag. The requirement is to automatically add the tag to new resources and update existing ones, which requires a policy with a Modify effect, not a role assignment.
★ When this WOULD be the correct answer
This option would be correct if the question asked: 'Management wants all team members to be able to view tags on resources in a resource group, but not modify them. Which role should be assigned?'
Why candidates choose this
Candidates may confuse role-based access control (RBAC) with Azure Policy, thinking that granting read access to tags will help enforce tagging, or they may assume that visibility is a prerequisite for automatic tagging.
✗Use only an Audit policy so teams can see missing tags.Wrong answer — click to see why▾
Why this is wrong here
An Audit policy only reports noncompliance but does not automatically add or update tags. The requirement is to automatically apply the CostCenter tag to new and existing resources, which requires a Modify policy with a remediation task, not just auditing.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a solution that only monitors tag compliance without automatically applying tags, and the organization wants to manually enforce tagging through reports.
Why candidates choose this
Candidates may think an Audit policy is sufficient because it identifies missing tags, but they overlook the requirement for automatic enforcement and remediation of existing resources.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Policy Remediation Tasks
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
About these practice questions
One of 1,053 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. The finance team wants every resource created in one resource group to carry the same CostCenter tag automatically. They want to reduce manual entry and keep the tag value consistent. What should you configure?
easy- A.Ask users to add the tag manually to every resource
- B.Assign a Reader role to the finance team
- C.Apply a CanNotDelete lock to the resource group
- ✓ D.Use Azure Policy to inherit the CostCenter tag from the resource group
Why D: Azure Policy can enforce tag inheritance from a resource group to all resources within it using the 'Inherit a tag from the resource group' built-in policy effect. This ensures the CostCenter tag is automatically applied to every new or existing resource without manual entry, maintaining consistency and reducing administrative overhead.
Variation 2. A finance team wants every resource created in one production resource group to carry CostCenter=PRD automatically. They do not want deployments blocked if a team forgets the tag, but they do want existing resources and future resources in that resource group to converge on the correct tag value. What should the administrator configure?
hard- A.Apply a CanNotDelete lock to the production resource group.
- ✓ B.Assign a modify policy for CostCenter=PRD at the production resource group scope and create a remediation task.
- C.Assign Contributor on the subscription and require teams to enter the tag manually.
- D.Set the tag on the management group and expect all resources to inherit it automatically.
Why B: Azure Policy with a 'modify' effect can automatically add or correct the CostCenter tag on resources within the specified scope. By assigning the policy at the production resource group scope and creating a remediation task, the policy will audit existing resources and, via a managed identity, apply the tag value to non-compliant resources without blocking deployment. This satisfies the requirement for automatic convergence without preventing creation if the tag is missing.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.