AZ-104 Manage Azure Identities and Governance Practice Question
New Azure subscriptions are created every month. Production subscriptions require stricter governance than sandbox subscriptions, and central IT wants those rules to apply automatically to any future production subscription without reconfiguring each one. What should they set up?
⚠ Common exam trap
Many exam-takers confuse resource groups or locks with management groups, failing to realize that only management groups provide hierarchical inheritance of governance across multiple subscriptions without per-subscription configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A management group hierarchy with production and sandbox child management groups, then assign governance at the appropriate scope.
Management groups allow you to build a hierarchy that reflects your organizational structure and apply governance policies (e.g., Azure Policy, RBAC) at the management group scope. By creating a 'Production' child management group under the root, any new subscription placed in that group automatically inherits the assigned policies and role assignments, eliminating the need to reconfigure each subscription individually.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Separate resource groups for production and sandbox workloads in each subscription.
Why it's wrong here
Resource groups are logical containers for resources inside a single subscription, and governance assigned to a resource group applies only to the resources within that group, not to the entire subscription or to future subscriptions. Creating separate resource groups for production and sandbox workloads allows you to manage resources distinctly, but it provides no mechanism to enforce policy or role assignments at a higher, subscription-transcending scope. New subscriptions arrive outside this structure, so no controls are applied automatically, and the resource group design does not establish an organizational hierarchy.
When this WOULD be correct
If the question asked how to isolate workloads within a single subscription while applying different policies to each workload, separating resource groups would be correct. For example, 'You need to apply different RBAC roles to production and test resources within one subscription.'
- ✓
A management group hierarchy with production and sandbox child management groups, then assign governance at the appropriate scope.
Why this is correct
Management groups provide a hierarchy for organizing subscriptions and applying governance that inherits to child scopes. Placing production and sandbox subscriptions under different child management groups lets central IT target different controls once, and the settings flow automatically to future subscriptions placed in those groups.
- ✗
A CanNotDelete lock on each subscription.
Why it's wrong here
A CanNotDelete lock placed on a subscription only prevents administrators and users from deleting that subscription or its resources through the Azure control plane; it has no effect on organizing production vs. sandbox subscriptions, nor does it apply governance like policies, tagging, or network controls. Locks are additive protections at a specific scope, and they do not scale to manage many subscriptions or the ongoing compliance of workloads created within them. Since the lock cannot differentiate between environments or assign environment-specific guardrails, it fails to address the core need for structural governance that follows new subscriptions automatically.
When this WOULD be correct
If the question asked for a way to prevent accidental deletion of a critical subscription while allowing all other operations, then a CanNotDelete lock on that subscription would be correct.
- ✗
A custom role assigned to each subscription owner.
Why it's wrong here
Assigning a custom role to each subscription owner only modifies identity permissions at the subscription scope through Role-Based Access Control, and those permissions do not inherit a governance baseline such as Azure Policy or tagging rules to resources. Custom roles define actions like 'read' or 'write' but cannot express compliance requirements or environment separation. Because the role is bound to individual owners rather than to the subscription structure, it must be recreated and assigned manually to every new subscription, and it does nothing to group subscriptions for centralized management.
When this WOULD be correct
If the question required granting specific permissions (e.g., read-only access) to a particular user or group for existing subscriptions without affecting future subscriptions, assigning a custom role to each subscription owner would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A management group hierarchy with production and sandbox child management groups, then assign governance at the appropriate scope.Correct answer▾
Why this is correct
Management groups provide a hierarchy for organizing subscriptions and applying governance that inherits to child scopes. Placing production and sandbox subscriptions under different child management groups lets central IT target different controls once, and the settings flow automatically to future subscriptions placed in those groups.
✗Separate resource groups for production and sandbox workloads in each subscription.Wrong answer — click to see why▾
Why this is wrong here
Resource groups organize resources within a subscription but do not enforce governance across multiple subscriptions or automatically apply rules to new subscriptions. The question requires automatic application of governance to new production subscriptions, which management groups provide.
★ When this WOULD be the correct answer
If the question asked how to isolate workloads within a single subscription while applying different policies to each workload, separating resource groups would be correct. For example, 'You need to apply different RBAC roles to production and test resources within one subscription.'
Why candidates choose this
Candidates may confuse resource groups with management groups, thinking that organizing resources into separate groups is sufficient for governance, but resource groups lack the hierarchical policy inheritance needed for cross-subscription management.
✗A CanNotDelete lock on each subscription.Wrong answer — click to see why▾
Why this is wrong here
A CanNotDelete lock prevents deletion of a subscription but does not enforce governance policies like tagging, RBAC, or compliance rules across multiple subscriptions automatically.
★ When this WOULD be the correct answer
If the question asked for a way to prevent accidental deletion of a critical subscription while allowing all other operations, then a CanNotDelete lock on that subscription would be correct.
Why candidates choose this
Candidates may confuse resource locks with governance policies, thinking that locking a subscription provides the same control as policy assignment, or they may overestimate the scope of locks.
✗A custom role assigned to each subscription owner.Wrong answer — click to see why▾
Why this is wrong here
Custom roles assigned to subscription owners do not automatically apply to new subscriptions; each new subscription would require manual role assignment, failing the requirement for automatic governance.
★ When this WOULD be the correct answer
If the question required granting specific permissions (e.g., read-only access) to a particular user or group for existing subscriptions without affecting future subscriptions, assigning a custom role to each subscription owner would be appropriate.
Why candidates choose this
Candidates may think custom roles provide fine-grained control and can be reused, but overlook that they must be explicitly assigned per subscription, not inherited automatically.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.