The answer is an Azure Policy assigned at the management group scope. This is the correct centralized governance solution because management groups act as containers for organizing subscriptions, and any policy assigned at that level is automatically inherited by all child subscriptions, enforcing a standard list of allowed Azure regions without needing to configure each subscription individually. On the AZ-104 exam, this scenario tests your understanding of Azure Policy inheritance and management group hierarchy, often appearing as a trap where candidates mistakenly choose a policy assigned per subscription or a resource lock—remember, locks prevent deletion, not deployment restrictions. The key distinction is that management group scope provides the centralized enforcement you need for consistent compliance across multiple subscriptions. Memory tip: think "one policy at the top, enforced all the way down" to recall that management group inheritance is the backbone of centralized governance.
AZ-104 Manage Azure Identities and Governance Practice Question
This AZ-104 practice question tests your understanding of manage azure identities and governance. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your company wants to enforce a standard list of allowed Azure regions for all new resource deployments across several subscriptions. You need a centralized governance solution that can be assigned once and inherited by the child subscriptions. What should you use?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An Azure Policy assigned at the management group scope
Azure Policy assigned at the management group scope is the correct centralized governance solution because it enforces a standard list of allowed Azure regions across all subscriptions under that management group. Policies at the management group level are inherited by all child subscriptions, ensuring consistent compliance without requiring individual assignment per subscription.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
An Azure Policy assigned at the management group scope
Why this is correct
A management group policy assignment is inherited by child subscriptions and can restrict allowed locations centrally.
Related concept
Read the scenario before looking for a memorised answer.
✗
A custom RBAC role assigned at each subscription
Why it's wrong here
RBAC controls permissions, not permitted deployment regions.
✗
A CanNotDelete lock on each subscription
Why it's wrong here
Locks prevent deletion or modification, not regional deployment choices.
✗
A budget alert on each subscription
Why it's wrong here
Budget alerts do not enforce deployment geography.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is confusing Azure Policy (which enforces rules on resource properties) with RBAC (which controls access permissions), leading candidates to incorrectly choose a custom RBAC role thinking it can restrict regions.
Detailed technical explanation
How to think about this question
Azure Policy uses policy definitions with conditions (e.g., 'location' field) and effects like 'Deny' to block non-compliant deployments. When assigned at the management group scope, the policy is evaluated against all resources in child subscriptions via Azure Resource Manager's policy evaluation engine during PUT requests. This inheritance model ensures that even new subscriptions added to the management group automatically inherit the policy, providing scalable governance.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-104 question in full detail.
Manage Azure Identities and Governance — This question tests Manage Azure Identities and Governance — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: An Azure Policy assigned at the management group scope — Azure Policy assigned at the management group scope is the correct centralized governance solution because it enforces a standard list of allowed Azure regions across all subscriptions under that management group. Policies at the management group level are inherited by all child subscriptions, ensuring consistent compliance without requiring individual assignment per subscription.
What should I do if I get this AZ-104 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer already has permission to create resource groups. The company wants to allow deployments only in the East US and West US regions. Which service should enforce this rule?
easy
A.Azure RBAC, because region selection is part of user permissions.
✓ B.Azure Policy, because it can restrict which regions are allowed for deployments.
C.A network security group, because it can block unsupported regions.
D.A read-only lock, because it limits changes to approved regions.
Why B: Azure Policy is the correct service because it enforces organizational rules by evaluating resource configurations against policy definitions. In this scenario, a built-in or custom policy can restrict allowed regions for all resources, ensuring deployments only occur in East US and West US. Unlike RBAC, which controls who can perform actions, Azure Policy controls what resource configurations are permitted, making it the appropriate tool for region restriction.
Variation 2. A subscription already grants Contributor to an application team. The organization wants to prevent deployments in unsupported Azure regions and ensure every new resource has an Environment tag. Which two controls should be implemented with Azure Policy rather than RBAC? Select two.
hard
✓ A.Assign an allowed-locations policy at the management group or subscription scope.
B.Create a custom RBAC role that blocks resources deployed outside approved regions.
✓ C.Assign a policy that enforces the Environment tag on new resources.
D.Add a CanNotDelete lock to every resource group.
E.Grant User Access Administrator to the deployment team.
Why A: Option A is correct because Azure Policy can enforce an 'allowed-locations' policy at the management group or subscription scope to restrict resource deployment to only approved Azure regions. This is a governance control that operates declaratively, evaluating resource properties against policy rules before or after creation, unlike RBAC which controls identity-based permissions. Option C is correct because Azure Policy can enforce the 'Environment' tag on new resources using a 'require a tag and its value' policy, ensuring compliance without modifying role assignments.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.