AZ-104 Manage Azure Identities and Governance Practice Question
A company wants to stop users from creating resources in any Azure region except East US and West US across all subscriptions. Which Azure feature should be used to enforce this requirement?
⚠ Common exam trap
Watch out — candidates often confuse Azure RBAC (who can do what) with Azure Policy (what can be done), leading them to select RBAC role assignments instead of the correct policy-based governance control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An Azure Policy assignment with a Deny effect at the management group scope
Azure Policy with a Deny effect at the management group scope is the correct choice because it can enforce a location constraint across all subscriptions under that management group. The Deny effect prevents the creation of resources in non-compliant regions at the time of deployment, ensuring that only East US and West US are allowed. This is a governance control that applies to all subscriptions within the scope, making it the ideal solution for this requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An Azure RBAC role assignment
Why it's wrong here
Assigning a role such as Contributor or Owner determines which users have permission to perform actions like 'Microsoft.Resources/deployments/write', but it does not constrain the allowed locations for the resources they deploy. RBAC assignments are at most scoped to a management group, subscription, or resource group, and that scope defines administrative boundaries, not regional boundaries. Even a user with only a limited role can choose any Azure region unless a separate control, such as Azure Policy, explicitly denies non-approved locations.
When this WOULD be correct
An Azure RBAC role assignment would be correct if the question asked: 'A company wants to allow only a specific group of users to manage virtual machines in a subscription, while preventing others from doing so.'
- ✓
An Azure Policy assignment with a Deny effect at the management group scope
Why this is correct
Assigning the built-in 'Allowed Locations' policy definition at the management group scope with the Deny effect makes Azure Resource Manager evaluate every create or update request against the allowed region list before any deployment proceeds. If a user attempts to provision a resource in a disallowed Azure region, the request is rejected with a 403 conflict error, regardless of the user's RBAC permissions or the subscription's current role assignment. Because the policy assignment is at the management group level, the rule is inherited by all subscriptions and resource groups beneath it, creating an organisation-wide regional boundary.
- ✗
A CanNotDelete resource lock on the subscriptions
Why it's wrong here
A CanNotDelete lock is placed on an existing subscription or resource to protect it from deletion or modification; it has no bearing on the evaluation of new resource creation requests. The lock simply blocks REST operations that delete or update a scoped resource, but it never inspects the 'location' property of a planned deployment. Therefore a user could still create fresh resources in any region under the locked subscription, because locks are not part of the resource creation validation path.
When this WOULD be correct
A company wants to prevent accidental deletion of critical resources in a production subscription. Applying a CanNotDelete lock at the subscription scope ensures that no resources can be deleted until the lock is removed.
- ✗
A tag inheritance rule on the management group
Why it's wrong here
A tag inheritance rule, such as Azure Policy's 'inherit a tag from the resource group' effect, merely copies metadata onto resources and resource groups for cost tracking, classification, or automation. Tags carry no enforcement semantics and are never evaluated by the resource provider when deciding whether a deployment is allowed in a particular location. A resource or resource group can be created in an unapproved region and still be tagged correctly, so tags cannot prevent users from provisioning outside the approved Azure regions.
When this WOULD be correct
A company wants to automatically apply a 'CostCenter' tag to all resources created under a management group, ensuring consistent tagging for cost tracking across subscriptions.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An Azure Policy assignment with a Deny effect at the management group scopeCorrect answer▾
Why this is correct
Assigning the built-in 'Allowed Locations' policy definition at the management group scope with the Deny effect makes Azure Resource Manager evaluate every create or update request against the allowed region list before any deployment proceeds. If a user attempts to provision a resource in a disallowed Azure region, the request is rejected with a 403 conflict error, regardless of the user's RBAC permissions or the subscription's current role assignment. Because the policy assignment is at the management group level, the rule is inherited by all subscriptions and resource groups beneath it, creating an organisation-wide regional boundary.
✗An Azure RBAC role assignmentWrong answer — click to see why▾
Why this is wrong here
Azure RBAC role assignments control permissions to perform actions on resources, but they cannot enforce restrictions on which Azure regions can be used to create resources. RBAC does not have a built-in capability to deny region-specific resource creation.
★ When this WOULD be the correct answer
An Azure RBAC role assignment would be correct if the question asked: 'A company wants to allow only a specific group of users to manage virtual machines in a subscription, while preventing others from doing so.'
Why candidates choose this
Candidates may confuse RBAC with Azure Policy, thinking that role assignments can deny actions based on region, but RBAC focuses on who can perform actions, not on what conditions (like region) are allowed.
✗A CanNotDelete resource lock on the subscriptionsWrong answer — click to see why▾
Why this is wrong here
A CanNotDelete resource lock prevents deletion of resources but does not restrict resource creation to specific Azure regions. It cannot enforce regional constraints across subscriptions.
★ When this WOULD be the correct answer
A company wants to prevent accidental deletion of critical resources in a production subscription. Applying a CanNotDelete lock at the subscription scope ensures that no resources can be deleted until the lock is removed.
Why candidates choose this
Candidates may confuse resource locks with policy enforcement, thinking that a lock can block all operations including creation, or they may assume that locks can restrict resource location.
✗A tag inheritance rule on the management groupWrong answer — click to see why▾
Why this is wrong here
Tag inheritance rules only propagate tags from a management group to subscriptions or resources; they do not enforce region restrictions or deny resource creation in disallowed regions.
★ When this WOULD be the correct answer
A company wants to automatically apply a 'CostCenter' tag to all resources created under a management group, ensuring consistent tagging for cost tracking across subscriptions.
Why candidates choose this
Candidates may confuse tag inheritance with policy enforcement, thinking that inheriting a 'region' tag could restrict creation, but tags alone have no effect on resource provisioning.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Region
A region is a distinct geographic location where a cloud provider operates multiple data centers that are connected by low-latency networks and provide cloud services.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.