AZ-104 Manage Azure Identities and Governance Practice Question
Your company has separate subscriptions for development, test, and production. Security wants one baseline policy and one RBAC assignment to apply automatically to every production subscription now and in the future. What should you use?
⚠ Common exam trap
Many exam-takers confuse tags with policy enforcement, thinking tags can automatically apply governance, when in fact tags are only metadata and require Azure Policy to enforce tag inheritance or compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A management group above the production subscriptions.
B is correct because management groups allow you to apply Azure Policy and RBAC assignments hierarchically. By placing all production subscriptions under a single management group, any policy or role assignment at that level will be inherited by every current and future production subscription, meeting the requirement for automatic application without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A resource group that contains all production resources.
Why it's wrong here
A resource group cannot contain resources from multiple subscriptions; it is a logical container that lives within a single subscription, and its management scope is limited to the resources in that one group. Trying to put all production resources into one resource group would require redesigning the environment and moving resources across subscriptions, which resource groups do not allow. Additionally, resource groups do not provide any inheritance mechanism across subscriptions, so this option is far too small and inflexible for governing multiple subscriptions.
When this WOULD be correct
If the question asked for applying a policy or RBAC assignment to all resources within a single production subscription, and the requirement was to manage resources collectively, then a resource group containing all production resources could be the correct scope.
- ✓
A management group above the production subscriptions.
Why this is correct
A management group above the production subscriptions is the correct parent scope because Azure management groups are designed to organize subscriptions into a hierarchy and deliver governance through inheritance. By placing a management group above all production subscriptions, RBAC role assignments and Azure Policy definitions applied at that group are automatically inherited by every child subscription, enabling consistent cross-subscription management without duplication. This scope supports multiple production subscriptions and provides a natural boundary for organizational structure, such as dev and production environments.
- ✗
A tag applied to each production resource.
Why it's wrong here
Tags are key-value metadata attached to resources, helpful for cost reporting, organization, and filtering, but they do not provide any enforcement capability like RBAC or Azure Policy inheritance. A tag cannot define a management hierarchy; it does not cause policies or role assignments to propagate across resources or subscriptions. Even if every production resource were tagged, you would still need to apply governance at a subscription or management group scope, so tags alone are insufficient for the stated requirement of multiple subscriptions.
When this WOULD be correct
A question requiring cost tracking or resource grouping across subscriptions, where the goal is to identify resources by environment (e.g., 'production') for reporting or automation, and the policy/RBAC is applied at the resource level via tag-based conditions.
- ✗
A single production subscription with multiple resource groups.
Why it's wrong here
Consolidating all production environments into a single subscription with multiple resource groups would mean losing the separation that distinct subscriptions provide, which is often needed for billing isolation, administrative boundaries, or compliance. More importantly, resource groups within one subscription are all under that single subscription's management scope; they do not create any inheritance relationship across separate subscriptions. This approach would force a migration and redesign of the existing production subscriptions, rather than solving the cross-subscription governance requirement directly.
When this WOULD be correct
If the question required managing resources within a single subscription and applying a baseline policy and RBAC assignment to all resources in that subscription, using a single subscription with multiple resource groups would be appropriate, as policies and assignments can be applied at the subscription level.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A management group above the production subscriptions.Correct answer▾
Why this is correct
A management group above the production subscriptions is the correct parent scope because Azure management groups are designed to organize subscriptions into a hierarchy and deliver governance through inheritance. By placing a management group above all production subscriptions, RBAC role assignments and Azure Policy definitions applied at that group are automatically inherited by every child subscription, enabling consistent cross-subscription management without duplication. This scope supports multiple production subscriptions and provides a natural boundary for organizational structure, such as dev and production environments.
✗A resource group that contains all production resources.Wrong answer — click to see why▾
Why this is wrong here
A resource group is not a scope for policy or RBAC assignment that applies automatically to multiple subscriptions; it only applies to resources within that specific resource group, not to all production subscriptions.
★ When this WOULD be the correct answer
If the question asked for applying a policy or RBAC assignment to all resources within a single production subscription, and the requirement was to manage resources collectively, then a resource group containing all production resources could be the correct scope.
Why candidates choose this
Candidates may think a resource group can aggregate resources across subscriptions for policy application, but resource groups are subscription-scoped and cannot span multiple subscriptions.
✗A tag applied to each production resource.Wrong answer — click to see why▾
Why this is wrong here
Tags are not inherited by default and require explicit assignment to each resource; they cannot automatically apply a baseline policy or RBAC assignment to all production subscriptions now and in the future.
★ When this WOULD be the correct answer
A question requiring cost tracking or resource grouping across subscriptions, where the goal is to identify resources by environment (e.g., 'production') for reporting or automation, and the policy/RBAC is applied at the resource level via tag-based conditions.
Why candidates choose this
Candidates may think tags can enforce policies or RBAC universally, or they confuse tagging with inheritance mechanisms like management groups.
✗A single production subscription with multiple resource groups.Wrong answer — click to see why▾
Why this is wrong here
A single production subscription with multiple resource groups does not automatically apply policies and RBAC assignments to future production subscriptions; it only covers one subscription, not multiple separate subscriptions.
★ When this WOULD be the correct answer
If the question required managing resources within a single subscription and applying a baseline policy and RBAC assignment to all resources in that subscription, using a single subscription with multiple resource groups would be appropriate, as policies and assignments can be applied at the subscription level.
Why candidates choose this
Candidates may think that consolidating all production resources into one subscription simplifies management, overlooking the requirement to automatically cover future separate production subscriptions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Role assignment
Role assignment is the process of granting a specific set of permissions to a user, group, or service principal so they can perform certain actions within a system.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to group several subscriptions for Finance, HR, and Engineering so that the same governance settings can be applied above the subscription level. What should the administrator create?
easy- ✓ A.A management group
- B.A resource group
- C.A tag
- D.A resource lock
Why A: A management group is the correct choice because it allows you to organize multiple Azure subscriptions into a hierarchy and apply governance policies, role-based access control (RBAC), and compliance settings at a scope above the subscription level. By creating a management group for Finance, HR, and Engineering, the administrator can enforce consistent Azure Policy initiatives and RBAC assignments across all three subscriptions, ensuring uniform governance without needing to configure each subscription individually.
Variation 2. An enterprise has a management group named Corp. Corp contains two child management groups: Prod and Sandbox. A compliance auditor is a member of an Entra ID group and must have read-only access to every current and future resource in all subscriptions that are under Prod. The auditor must not see resources in Sandbox, and the admin does not want to maintain separate assignments for each new subscription. What should the administrator do?
hard- A.Assign the Reader role to the group at each subscription scope under Prod.
- B.Assign the Reader role to the group at the Corp management group scope.
- ✓ C.Assign the Reader role to the group at the Prod management group scope.
- D.Assign the Reader role to the group at one resource group in each Prod subscription.
Why C: Assigning the Reader role at the Prod management group scope applies that permission to all current and future subscriptions and resources within Prod, satisfying the requirement for read-only access without needing separate assignments. Management groups in Azure provide a hierarchical scope that inherits role assignments to all child subscriptions and resource groups, making this the most efficient and future-proof approach.
Variation 3. An enterprise has a management group named Corp that contains all production and sandbox subscriptions. An Entra ID group named Auditors must be able to read resources in every current subscription under Corp and in any subscription added later. Which two actions should the administrator take? Select two.
medium- ✓ A.Assign the Reader role to the Auditors group at the Corp management group scope.
- B.Assign the Reader role directly to every subscription under Corp.
- C.Assign the Reader role to the Auditors group at one resource group scope.
- ✓ D.Add the intended users to the Auditors Entra ID group.
- E.Create an Azure Policy assignment to grant read access to all subscriptions.
Why A: Assigning the Reader role to the Auditors group at the Corp management group scope ensures that the group receives read permissions to all current and future subscriptions and resource groups under Corp, because Azure RBAC permissions assigned at a management group are inherited by all child scopes. This satisfies the requirement for both existing and future subscriptions without manual updates. In addition, the intended users must be added as members of the Auditors Entra ID group, because the role assignment grants permissions to the group, not to individual users. Therefore, both actions are necessary: the role assignment at the correct scope and populating the group with the auditors.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.