AZ-104 Manage Azure Identities and Governance Practice Question
The platform team wants every resource deployed in a subscription to include an Environment tag. New resources that do not meet the rule must be blocked, and existing noncompliant resources should appear in compliance reports. What should be configured?
⚠ Common exam trap
Many candidates confuse Azure Policy (which enforces rules and blocks noncompliant resources) with RBAC roles (which control permissions) or resource locks (which prevent accidental deletion), failing to recognize that only Azure Policy can both block new noncompliant resources and report on existing ones.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An Azure Policy assignment at the subscription scope with a deny effect.
Azure Policy with a deny effect at the subscription scope is the correct choice because it enforces a rule that blocks the creation or update of any resource that does not include the required 'Environment' tag. The deny effect actively prevents noncompliant deployments, while the policy itself evaluates existing resources and marks them as noncompliant in compliance reports, meeting both requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An Azure Policy assignment at the subscription scope with a deny effect.
Why this is correct
Azure Policy is the governance feature that evaluates resources against rules, reports compliance, and can block noncompliant deployments when the deny effect is used. Assigning it at the subscription scope applies the rule to all resources in that subscription. This matches the requirement to enforce tagging and to show existing noncompliant resources in compliance views.
- ✗
A Contributor role assignment at the subscription scope.
Why it's wrong here
A Contributor role assignment at the subscription scope grants a user or group full create, read, update, and delete rights on all resources in that subscription. It does not evaluate or enforce tag requirements, nor does it produce any compliance reports indicating which resources are noncompliant. RBAC decides who can perform actions, while Azure Policy decides whether those actions are allowed based on resource properties—so Contributor alone cannot meet the enforcement and audit requirement.
When this WOULD be correct
When the requirement is to delegate resource management capabilities (e.g., create, modify, delete resources) within a subscription to a user or group, without needing to enforce specific compliance rules.
- ✗
A resource lock on the subscription.
Why it's wrong here
A resource lock at the subscription scope only prevents accidental deletion or modification of the subscription and its resources at the control plane. It does nothing to validate tag existence or values on resources, and it provides no compliance reporting that would show which resources are missing required tags. Locks are designed to protect management operations, not to enforce governance standards or audit configuration compliance.
When this WOULD be correct
A resource lock on a subscription would be correct in a scenario where the goal is to prevent accidental deletion or modification of all resources in the subscription, such as protecting a production environment from administrative mistakes.
- ✗
A custom RBAC role that includes tag write permissions.
Why it's wrong here
Tag write permission might let someone add tags manually, but it does not enforce a standard or block noncompliant deployments. RBAC grants access; it does not evaluate or deny resource configuration based on policy rules.
When this WOULD be correct
This option would be correct in a scenario where the requirement is to delegate the ability to add or modify tags to a specific group of users, without enforcing any compliance rules. For example, 'You need to allow the operations team to add an Environment tag to resources, but they should not have other write permissions.'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An Azure Policy assignment at the subscription scope with a deny effect.Correct answer▾
Why this is correct
Azure Policy is the governance feature that evaluates resources against rules, reports compliance, and can block noncompliant deployments when the deny effect is used. Assigning it at the subscription scope applies the rule to all resources in that subscription. This matches the requirement to enforce tagging and to show existing noncompliant resources in compliance views.
✗A Contributor role assignment at the subscription scope.Wrong answer — click to see why▾
Why this is wrong here
A Contributor role assignment grants broad management permissions but does not enforce tagging rules or block noncompliant resources; it cannot prevent deployment of untagged resources or report on compliance.
★ When this WOULD be the correct answer
When the requirement is to delegate resource management capabilities (e.g., create, modify, delete resources) within a subscription to a user or group, without needing to enforce specific compliance rules.
Why candidates choose this
Candidates may think that assigning a role with write permissions can enforce tagging, confusing authorization with policy enforcement, or they may believe Contributor can be used to apply tags automatically.
✗A resource lock on the subscription.Wrong answer — click to see why▾
Why this is wrong here
A resource lock prevents deletion or modification of resources but does not enforce tagging requirements or block creation of noncompliant resources. It cannot report noncompliant resources or deny deployment of untagged resources.
★ When this WOULD be the correct answer
A resource lock on a subscription would be correct in a scenario where the goal is to prevent accidental deletion or modification of all resources in the subscription, such as protecting a production environment from administrative mistakes.
Why candidates choose this
Candidates may confuse resource locks with policy enforcement, thinking a lock can prevent creation of resources that don't meet criteria, but locks only protect existing resources from changes, not enforce compliance on new deployments.
✗A custom RBAC role that includes tag write permissions.Wrong answer — click to see why▾
Why this is wrong here
A custom RBAC role with tag write permissions allows users to add tags but does not enforce a policy to block noncompliant resources or report existing noncompliant resources. Azure Policy with deny effect is required to enforce tagging rules and generate compliance reports.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the requirement is to delegate the ability to add or modify tags to a specific group of users, without enforcing any compliance rules. For example, 'You need to allow the operations team to add an Environment tag to resources, but they should not have other write permissions.'
Why candidates choose this
Candidates may think that controlling tag write permissions via RBAC can enforce tagging rules, confusing authorization with policy enforcement. They might overlook that RBAC does not provide compliance reporting or block creation of noncompliant resources.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A team wants every resource in a subscription to include a Department tag. New resources that do not have the tag should be blocked from being created. Which Azure Policy effect should you use?
easy- A.Audit
- ✓ B.Deny
- C.Append
- D.Disabled
Why B: The Deny effect is correct because it actively blocks any resource creation or update request that does not include the required Department tag, enforcing compliance at the time of the operation. Unlike Audit, which only logs non-compliant resources, Deny prevents the non-compliant resource from being provisioned, directly meeting the requirement to block new resources without the tag.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.