AZ-104 Manage Azure Identities and Governance Practice Question
A company wants to stop users from creating resources in regions that are not approved and also require a Department tag on new resources. Which two tasks are best handled by Azure Policy? Select two.
⚠ Common exam trap
Watch out — candidates often confuse Azure Policy with Azure RBAC or resource locks, thinking that policy can manage user permissions or prevent deletion, when in fact policy is solely for enforcing rules on resource properties like location and tags.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict allowed deployment locations.
Azure Policy can enforce organizational standards by evaluating resource properties against business rules. Option A is correct because the 'Allowed Locations' policy definition restricts users from deploying resources to any region not explicitly permitted, directly addressing the requirement to block unapproved regions. Option B is correct because the 'Require a tag and its value on resources' policy definition can enforce that a Department tag must exist on all new resources, ensuring compliance with tagging requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Restrict allowed deployment locations.
Why this is correct
Azure Policy is designed to enforce configuration standards such as allowed locations. It can block or audit deployments that do not match the approved region list, which is a compliance requirement rather than an access-control requirement.
- ✓
Require a Department tag on resources.
Why this is correct
The 'Require a tag' policy definition (or 'Require tag and its value') is a valid Azure Policy assignment because Azure Resource Manager evaluates it during deployment, returning a denial if the Department tag is absent or has the wrong value. This enforces metadata compliance without relying on user behavior, which is exactly how Azure Policy enforces organizational standards. It complements the allowed-location policy by ensuring every resource both lands in an approved region and carries the required cost-allocation metadata.
- ✗
Give users Contributor access to the subscription.
Why it's wrong here
Granting Contributor access at subscription scope gives users full management rights for resources, but RBAC permissions are orthogonal to Azure Policy. Contributor allows a user to deploy to any location or with any tags; only a policy assignment can block those actions. This would make governance less restrictive and would not address the requirement to restrict regions or enforce tags.
When this WOULD be correct
If the question asked 'Which Azure service should you use to grant users Contributor access to the subscription?', then 'Give users Contributor access to the subscription' would be correct, as it is an RBAC assignment.
- ✗
Create Microsoft Entra ID users for contractors.
Why it's wrong here
Microsoft Entra ID users are identities used for authentication and authorization; creating them does not affect Azure Policy evaluations. Policy assignments operate on Azure resources and their properties, not on identity objects. Contractors who receive Entra ID accounts are still subject to the same policies as employees, but the accounts themselves cannot enforce region or tag rules.
When this WOULD be correct
In a scenario where the question asks about managing user identities or automating user provisioning for contractors, the correct answer would be to create Microsoft Entra ID users, possibly via Microsoft Entra ID administration or automation tools.
- ✗
Place a CanNotDelete lock on every resource group.
Why it's wrong here
A CanNotDelete lock is applied to a resource group to prevent deletion of the group or the resources within it. This lock does not influence Azure Resource Manager's deployment-time policy evaluation; a user could still create resources in any region or skip required tags. Locks are an operational protection mechanism, not a compliance enforcement mechanism, so they cannot stop noncompliant deployments.
When this WOULD be correct
A company wants to prevent accidental deletion of all resource groups in a subscription. In that scenario, assigning a CanNotDelete lock at the subscription or resource group level would be the correct approach.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Restrict allowed deployment locations.Correct answer▾
Why this is correct
Azure Policy is designed to enforce configuration standards such as allowed locations. It can block or audit deployments that do not match the approved region list, which is a compliance requirement rather than an access-control requirement.
✗Give users Contributor access to the subscription.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy does not manage role-based access control (RBAC) like granting Contributor access. RBAC is handled by Azure role-based access control, not Azure Policy.
★ When this WOULD be the correct answer
If the question asked 'Which Azure service should you use to grant users Contributor access to the subscription?', then 'Give users Contributor access to the subscription' would be correct, as it is an RBAC assignment.
Why candidates choose this
Candidates may confuse Azure Policy with Azure RBAC, thinking policy can assign permissions, or they may mistakenly believe that restricting actions (like creating resources) is the same as granting permissions.
✗Create Microsoft Entra ID users for contractors.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy does not manage user identities; creating Microsoft Entra ID users is an identity management task handled by Microsoft Entra ID, not Azure Policy.
★ When this WOULD be the correct answer
In a scenario where the question asks about managing user identities or automating user provisioning for contractors, the correct answer would be to create Microsoft Entra ID users, possibly via Microsoft Entra ID administration or automation tools.
Why candidates choose this
Candidates may confuse Azure Policy with broader governance tools, thinking it can handle identity creation, or they may misassociate 'policy' with any administrative task.
✗Place a CanNotDelete lock on every resource group.Wrong answer — click to see why▾
Why this is wrong here
Placing a CanNotDelete lock on every resource group does not address the requirement to restrict regions or enforce tagging; it prevents deletion of resource groups, which is unrelated to the stated goals.
★ When this WOULD be the correct answer
A company wants to prevent accidental deletion of all resource groups in a subscription. In that scenario, assigning a CanNotDelete lock at the subscription or resource group level would be the correct approach.
Why candidates choose this
Candidates may confuse locks with policy, thinking that locks can enforce compliance, or they may overestimate the scope of locks as a governance tool.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Policy definition
A policy definition is a formal rule or set of rules that specifies allowed or denied actions on resources within an IT environment, often used for governance, compliance, and security control.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to stop users from deploying resources in any region except East US and West US. Users still need to be able to create resources if they choose an approved region. Which Azure feature should the administrator use?
medium- A.Azure RBAC with a Contributor role at the subscription scope.
- ✓ B.Azure Policy with a deny effect assigned at the appropriate scope.
- C.A resource lock at the subscription level.
- D.A tag requirement in Azure RBAC.
Why B: Azure Policy with a deny effect can enforce that resource deployments are only allowed in specified regions (East US and West US) by evaluating the location property of the resource against a policy definition. When a user attempts to deploy a resource in a non-approved region, the policy engine rejects the request before any resource creation begins, ensuring compliance without blocking approved regions.
Variation 2. Your company wants every subscription under the Corp-MG management group to block the creation of resource groups unless the deployment includes the tags CostCenter and Environment. You need a centralized solution that is inherited by child subscriptions. What should you configure?
hard- ✓ A.An Azure Policy assignment at the management group scope
- B.A custom RBAC role at the tenant root
- C.A CanNotDelete lock on each subscription
- D.A subscription budget alert
Why A: Azure Policy at the management group scope is the correct centralized solution because it enforces a policy (e.g., requiring tags) that is inherited by all child subscriptions and resource groups. This ensures that any deployment without the required tags is denied, meeting the requirement for a governance rule that applies across the entire Corp-MG hierarchy.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.