The platform team wants every resource deployed in a subscription to include an Environment tag. New resources that do not meet the rule must be blocked, and existing noncompliant resources should appear in compliance reports. What should be configured?

A Contributor role assignment at the subscription scope.

Contributor only controls what a user can do. It does not enforce tag requirements or produce compliance reporting for resource configurations. Permissions and policy are separate controls in Azure.

A resource lock on the subscription.

A lock prevents certain management actions, such as deletion or modification, but it cannot validate whether resources have required tags. It also does not generate policy compliance reports.

A custom RBAC role that includes tag write permissions.

Tag write permission might let someone add tags manually, but it does not enforce a standard or block noncompliant deployments. RBAC grants access; it does not evaluate or deny resource configuration based on policy rules.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: An Azure Policy assignment at the subscription scope with a deny effect. — Azure Policy is designed to enforce governance rules such as required tags, approved locations, or allowed SKUs. A subscription-scope assignment ensures all resources in that subscription are evaluated. With the deny effect, new resources missing the Environment tag are blocked, while existing noncompliant resources appear in compliance reporting for visibility and follow-up. Why others are wrong: RBAC roles control authorization, not configuration compliance. Locks prevent changes to resources but do not validate tags or provide compliance state. A custom role with tag permissions would still require people to remember to use it correctly, which is not enforcement. Only Azure Policy addresses both blocking and compliance reporting.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.