Manage Azure Identities and Governance →easyMultiple ChoiceObjective-mapped

AZ-104 Manage Azure Identities and Governance Practice Question

The finance team wants every resource created in one resource group to carry the same CostCenter tag automatically. They want to reduce manual entry and keep the tag value consistent. What should you configure?

⚠ Common exam trap

Many exam-takers confuse Azure Policy's tag inheritance with Azure RBAC roles or resource locks, as candidates often mistakenly think a Reader role or a lock can enforce tag consistency, when only Policy can automatically apply tags at scale.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use Azure Policy to inherit the CostCenter tag from the resource group

Azure Policy can enforce tag inheritance from a resource group to all resources within it using the 'Inherit a tag from the resource group' built-in policy effect. This ensures the CostCenter tag is automatically applied to every new or existing resource without manual entry, maintaining consistency and reducing administrative overhead.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Ask users to add the tag manually to every resource
Why it's wrong here
Relying on users to manually add the CostCenter tag to every resource is unreliable because it depends on individual compliance and has no enforcement mechanism. Users may forget the tag, mistype its value, or apply it inconsistently across environments, which leads to gaps in cost reporting and defeats the finance team's need for uniform data. Azure Policy exists precisely to eliminate this human error by automatically applying or correcting tags, whereas manual tagging offers no audit trail or automated correction.
When this WOULD be correct
If the question asked how to allow the finance team to view resource costs without making changes, assigning a Reader role would be correct. For example: 'The finance team needs to review resource costs but should not be able to modify resources. What should you configure?'
✗
Assign a Reader role to the finance team
Why it's wrong here
The Reader role grants read-only access to Azure resources and resource groups, allowing the finance team to view resource metadata including tags, but it does not grant permission to create, modify, or propagate tags on resources. RBAC roles control who can perform actions on existing resources, not what happens automatically when a new resource is provisioned—so assigning Reader cannot enforce that new resources receive the CostCenter tag. In fact, even Contributor or Owner roles would not automatically add tags; only Azure Policy or infrastructure-as-code templates can provide that kind of governance.
When this WOULD be correct
In a scenario where the finance team needs to audit or review resource costs and tags across subscriptions, assigning a Reader role at the subscription or resource group level would grant them read-only access to view tag values and cost data without making changes.
✗
Apply a CanNotDelete lock to the resource group
Why it's wrong here
A CanNotDelete lock at the resource group scope prevents users or automated processes from deleting the resource group or the resources within it, which is a protection against accidental data loss. However, a lock does not influence resource creation, does not add metadata, and does not copy tags from the resource group to child resources. Locks are for access protection, not for enforcing tagging standards, so the finance team would still have no guarantee that new resources carry the CostCenter tag for cost tracking.
When this WOULD be correct
If the question asked for a method to prevent accidental deletion of critical resources in a resource group, applying a CanNotDelete lock would be the correct answer.
✓
Use Azure Policy to inherit the CostCenter tag from the resource group
Why this is correct
Azure Policy can enforce consistent tagging by inheriting a tag value from the resource group to child resources. This reduces manual work and helps ensure that new resources receive the same CostCenter value automatically. It is a governance control, so it is the right feature when the goal is standardization rather than access control.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

✓Use Azure Policy to inherit the CostCenter tag from the resource groupCorrect answer▾

Why this is correct

Azure Policy can enforce consistent tagging by inheriting a tag value from the resource group to child resources. This reduces manual work and helps ensure that new resources receive the same CostCenter value automatically. It is a governance control, so it is the right feature when the goal is standardization rather than access control.

✗Ask users to add the tag manually to every resourceWrong answer — click to see why▾

Why this is wrong here

Manual tagging does not reduce manual entry or ensure consistency; it relies on users to remember and correctly apply the tag every time, which contradicts the requirement for automation and consistency.

★ When this WOULD be the correct answer

If the question asked how to allow the finance team to view resource costs without making changes, assigning a Reader role would be correct. For example: 'The finance team needs to review resource costs but should not be able to modify resources. What should you configure?'

Why candidates choose this

Candidates may think manual tagging is a simple, direct solution and underestimate the need for automation, or they may not fully understand Azure Policy capabilities for tag inheritance.

✗Assign a Reader role to the finance teamWrong answer — click to see why▾

Why this is wrong here

Assigning a Reader role to the finance team allows them to view resources but does not automatically apply or enforce tags on resources. It does not reduce manual entry or ensure tag consistency.

★ When this WOULD be the correct answer

In a scenario where the finance team needs to audit or review resource costs and tags across subscriptions, assigning a Reader role at the subscription or resource group level would grant them read-only access to view tag values and cost data without making changes.

Why candidates choose this

Candidates may confuse role-based access control (RBAC) with governance features like Azure Policy, thinking that granting read access somehow enables automatic tagging or enforcement.

✗Apply a CanNotDelete lock to the resource groupWrong answer — click to see why▾

Why this is wrong here

Applying a CanNotDelete lock prevents deletion of the resource group or its resources but does not automatically apply or enforce tags, so it does not meet the requirement to inherit the CostCenter tag.

★ When this WOULD be the correct answer

If the question asked for a method to prevent accidental deletion of critical resources in a resource group, applying a CanNotDelete lock would be the correct answer.

Why candidates choose this

Candidates may confuse locks with policies, thinking that a lock can enforce tag inheritance, or they may assume that preventing deletion somehow ensures tag consistency.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

AZ-104 Manage Azure Identities and Governance Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question