The answer is an Azure Policy assignment at the management group scope. This is correct because Azure Policy assignments at the management group level are inherited by all child subscriptions and resource groups within that hierarchy, creating a centralized governance rule that blocks resource group creation unless the required CostCenter and Environment tags are present. On the AZ-104 exam, this scenario tests your understanding of policy inheritance and scope management—a common trap is to assign the policy at the subscription level, which would require repeating the assignment for each subscription rather than applying it once at the Corp-MG management group. Remember that management group scope enforces compliance across the entire organizational structure, making it the only solution that meets the requirement for a single, inherited rule. A helpful memory tip: "MG scope, one and done—policy flows down to every subscription and resource group under the sun."
AZ-104 Manage Azure Identities and Governance Practice Question
This AZ-104 practice question tests your understanding of manage azure identities and governance. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your company wants every subscription under the Corp-MG management group to block the creation of resource groups unless the deployment includes the tags CostCenter and Environment. You need a centralized solution that is inherited by child subscriptions. What should you configure?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An Azure Policy assignment at the management group scope
Azure Policy at the management group scope is the correct centralized solution because it enforces a policy (e.g., requiring tags) that is inherited by all child subscriptions and resource groups. This ensures that any deployment without the required tags is denied, meeting the requirement for a governance rule that applies across the entire Corp-MG hierarchy.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
An Azure Policy assignment at the management group scope
Why this is correct
Management group policy assignments are inherited and can enforce required tags centrally.
Related concept
Read the scenario before looking for a memorised answer.
✗
A custom RBAC role at the tenant root
Why it's wrong here
RBAC controls access permissions, not required metadata such as tags.
✗
A CanNotDelete lock on each subscription
Why it's wrong here
A lock does not validate whether required tags are present.
✗
A subscription budget alert
Why it's wrong here
A budget alert monitors spend and does not control deployment tags.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is confusing Azure Policy (which enforces rules on resource properties) with RBAC (which controls access) or locks (which prevent deletion), leading candidates to choose a permission-based or operational control instead of a governance policy.
Detailed technical explanation
How to think about this question
Azure Policy uses a combination of policy definitions (e.g., 'Require a tag on resource groups') and policy assignments at the management group scope, which are inherited by all child subscriptions via the Azure Resource Manager hierarchy. The policy effect 'Deny' or 'Modify' is evaluated during resource creation, and if the tags are missing, the deployment is blocked before any resource is provisioned. This inheritance is automatic and cannot be overridden by child subscriptions unless explicitly excluded.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A startup's cloud architect reviews their monthly bill and notices costs are higher than expected for a long-running batch job. Switching from on-demand instances to Reserved Instances — or using Spot/Preemptible VMs — can reduce compute costs by up to 72 %. Questions like this test whether you understand the tradeoffs between commitment, flexibility, and cost across cloud pricing models.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-104 question in full detail.
Manage Azure Identities and Governance — This question tests Manage Azure Identities and Governance — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: An Azure Policy assignment at the management group scope — Azure Policy at the management group scope is the correct centralized solution because it enforces a policy (e.g., requiring tags) that is inherited by all child subscriptions and resource groups. This ensures that any deployment without the required tags is denied, meeting the requirement for a governance rule that applies across the entire Corp-MG hierarchy.
What should I do if I get this AZ-104 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to stop users from creating resources in regions that are not approved and also require a Department tag on new resources. Which two tasks are best handled by Azure Policy? Select two.
easy
✓ A.Restrict allowed deployment locations.
✓ B.Require a Department tag on resources.
C.Give users Contributor access to the subscription.
D.Create Microsoft Entra ID users for contractors.
E.Place a CanNotDelete lock on every resource group.
Why A: Azure Policy can enforce organizational standards by evaluating resource properties against business rules. Option A is correct because the 'Allowed Locations' policy definition restricts users from deploying resources to any region not explicitly permitted, directly addressing the requirement to block unapproved regions. Option B is correct because the 'Require a tag and its value on resources' policy definition can enforce that a Department tag must exist on all new resources, ensuring compliance with tagging requirements.
Variation 2. A company wants to stop users from deploying resources in any region except East US and West US. Users still need to be able to create resources if they choose an approved region. Which Azure feature should the administrator use?
medium
A.Azure RBAC with a Contributor role at the subscription scope.
✓ B.Azure Policy with a deny effect assigned at the appropriate scope.
C.A resource lock at the subscription level.
D.A tag requirement in Azure RBAC.
Why B: Azure Policy with a deny effect can enforce that resource deployments are only allowed in specified regions (East US and West US) by evaluating the location property of the resource against a policy definition. When a user attempts to deploy a resource in a non-approved region, the policy engine rejects the request before any resource creation begins, ensuring compliance without blocking approved regions.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.