AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Assign the developer the Owner role on the subscription.

  Why it's wrong here

  Assigning the Owner role grants complete control over all resources, but Azure Policy deny effects take precedence over any RBAC role assignment, including Owner. The deny action is evaluated during resource creation and will block the operation even for the subscription administrator unless the policy is changed or an exemption is granted. Owner-level permissions also carry security risks and do not address the underlying governance requirement. The only way to proceed is to modify or exempt the specific policy that denies public IP addresses.

  When this WOULD be correct

  Assigning the Owner role would be correct if the developer needs to modify role assignments or policy definitions themselves, or if the deployment fails due to missing permissions that only Owner can grant, such as registering resource providers.

• ✓

  Modify or exempt the Azure Policy assignment that blocks public IP addresses.

  Why this is correct

  The error message indicates the deployment was denied by an Azure Policy assignment, not by a lack of RBAC permissions. Modifying the policy assignment (e.g., changing the effect from 'Deny' to 'Audit' or removing the assignment) directly removes the obstacle. Alternatively, an exemption on the specific scope can allow the public IP to be created while keeping the policy for compliance governance. This is the only option that addresses the root cause while preserving the developer's Contributor role.

• ✗

  Remove any lock from the virtual machine's resource group.

  Why it's wrong here

  Resource locks, such as CanNotDelete or ReadOnly, are designed to prevent accidental deletion or modification of critical resources, and they generate a lock-specific error like 'ScopeLocked' or 'The resource is locked'. The deployment failure explicitly states the request is denied by policy, so a lock is not the cause. Additionally, a lock on the resource group does not block creating a new public IP address; it would block operations on existing resources. Removing a lock would therefore have no effect on the policy denial.

• ✗

  Move the virtual machine to another management group.

  Why it's wrong here

  Moving the virtual machine to another management group only changes the scope from which policies are inherited. If the deny policy is assigned at a subscription or resource group level, the move to a different management group won't alter the effective policy on the destination resource group. Even if the new management group has no such policy, the original deployment that failed still targeted a scope where the deny applied, and the deployment needs to be re-run in a cleared scope. This option addresses the symptom of resource location, not the policy rule itself.

  When this WOULD be correct

  If the question stated that the subscription is under a management group with a policy that blocks public IPs, and the developer needs to deploy in a different management group without that policy, then moving the VM (or deploying in a different management group) would be correct. This scenario would require the developer to have permissions to create resources in the target management group.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question