AZ-104 Manage Azure Identities and Governance Practice Question
A company wants to stop users from deploying resources in any region except East US and West US. Users still need to be able to create resources if they choose an approved region. Which Azure feature should the administrator use?
⚠ Common exam trap
Watch out — candidates often confuse Azure Policy (which can enforce location restrictions with a deny effect) with Azure RBAC (which controls permissions but not resource properties) or resource locks (which protect against deletion/modification, not creation).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy with a deny effect assigned at the appropriate scope.
Azure Policy with a deny effect can enforce that resource deployments are only allowed in specified regions (East US and West US) by evaluating the location property of the resource against a policy definition. When a user attempts to deploy a resource in a non-approved region, the policy engine rejects the request before any resource creation begins, ensuring compliance without blocking approved regions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure RBAC with a Contributor role at the subscription scope.
Why it's wrong here
Assigning the Contributor role at the subscription scope grants users full management rights across all resources, including the ability to deploy resources in any region. RBAC authorizes the principal based on the action (e.g., Microsoft.Resources/deployments/write), but it does not examine the parameters or properties of that action. Therefore, a Contributor user is permitted to create anything anywhere, which does not satisfy the requirement to restrict deployments to East US only.
When this WOULD be correct
An administrator needs to grant a user full management access to all resources in a subscription, but not allow them to change access permissions for others. Assigning the Contributor role at the subscription scope would be correct.
- ✓
Azure Policy with a deny effect assigned at the appropriate scope.
Why this is correct
Azure Policy is designed for compliance and enforcement. A policy that checks the location property and uses a deny effect can block deployments outside the approved regions while still allowing valid deployments in East US or West US. This meets the requirement without changing the users' general ability to create resources.
- ✗
A resource lock at the subscription level.
Why it's wrong here
A resource lock assigned at the subscription scope (such as CanNotDelete or ReadOnly) is an access-control safeguard that prevents existing resources from being deleted or changed. However, locks are not evaluated during the creation of new resources and they do not inspect or validate the location property of a deployment. Consequently, a user could still create a resource in an unauthorized region because the lock fails to block or flag the non-compliant deployment.
When this WOULD be correct
An administrator needs to prevent accidental deletion of critical resources in a subscription, such as a production database, while still allowing updates. A resource lock (e.g., CanNotDelete) at the resource group or resource level would be the correct solution.
- ✗
A tag requirement in Azure RBAC.
Why it's wrong here
Azure RBAC does not support tag-based requirements as a native enforcement mechanism; tags are metadata, not security principals or roles. While you can enforce mandatory tags using Azure Policy (with a deny effect if the tag is absent), RBAC itself only controls authorization for actions and cannot evaluate the presence or value of a tag on a deployment. So a tag requirement in RBAC would not prevent users from deploying to West US, because the condition is outside RBAC's evaluation scope.
When this WOULD be correct
An administrator needs to ensure that all resources in a subscription have a specific tag (e.g., 'CostCenter') applied automatically during creation. Azure Policy with a 'deny' effect for missing tags would enforce this, but if the requirement is to use RBAC, a custom role with a condition requiring the tag could be used, though Policy is more common.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Policy with a deny effect assigned at the appropriate scope.Correct answer▾
Why this is correct
Azure Policy is designed for compliance and enforcement. A policy that checks the location property and uses a deny effect can block deployments outside the approved regions while still allowing valid deployments in East US or West US. This meets the requirement without changing the users' general ability to create resources.
✗Azure RBAC with a Contributor role at the subscription scope.Wrong answer — click to see why▾
Why this is wrong here
Azure RBAC with a Contributor role grants broad permissions to create and manage resources but does not restrict which regions can be used. It allows resource creation in any region, not just East US and West US.
★ When this WOULD be the correct answer
An administrator needs to grant a user full management access to all resources in a subscription, but not allow them to change access permissions for others. Assigning the Contributor role at the subscription scope would be correct.
Why candidates choose this
Candidates may think that assigning a role like Contributor can be used to control resource locations, confusing authorization (who can act) with enforcement (what actions are allowed).
✗A resource lock at the subscription level.Wrong answer — click to see why▾
Why this is wrong here
A resource lock at the subscription level prevents deletion or modification of all resources, but does not restrict resource creation to specific regions; it blocks all changes indiscriminately.
★ When this WOULD be the correct answer
An administrator needs to prevent accidental deletion of critical resources in a subscription, such as a production database, while still allowing updates. A resource lock (e.g., CanNotDelete) at the resource group or resource level would be the correct solution.
Why candidates choose this
Candidates may confuse resource locks with policy-based restrictions, thinking that a lock can block resource creation in disallowed regions, but locks only protect existing resources from deletion or modification.
✗A tag requirement in Azure RBAC.Wrong answer — click to see why▾
Why this is wrong here
Tag requirements in Azure RBAC cannot restrict resource deployment by region; they only enforce tagging on resources, not control which regions are allowed.
★ When this WOULD be the correct answer
An administrator needs to ensure that all resources in a subscription have a specific tag (e.g., 'CostCenter') applied automatically during creation. Azure Policy with a 'deny' effect for missing tags would enforce this, but if the requirement is to use RBAC, a custom role with a condition requiring the tag could be used, though Policy is more common.
Why candidates choose this
Candidates may confuse tag enforcement with regional restrictions, thinking that requiring a tag like 'Region' could control where resources are deployed, but tags do not prevent deployment in disallowed regions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Policy definition
A policy definition is a formal rule or set of rules that specifies allowed or denied actions on resources within an IT environment, often used for governance, compliance, and security control.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.