AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Remove the policy assignment from Corp-MG.

  Why it's wrong here

  Removing the policy assignment from Corp-MG is wrong because that management group assignment applies to all child management groups, subscriptions, and resource groups within its hierarchy. Deleting it would immediately stop policy evaluation for every single resource under Corp-MG, which is far too broad for a single exception on the production subscription or application resource group. It also removes the associated compliance reporting and enforcement for the entire organization, leaving all other workloads ungoverned. A scoped exemption is the proper way to exclude only the specific deployment from the Deny effect without affecting other scopes.

  When this WOULD be correct

  If the question stated that the tag requirement is no longer needed for any resources across the organization, and you need to completely remove the policy enforcement, then removing the assignment at Corp-MG would be correct.

• ✓

  Create a policy exemption at the Prod-Sub or RG-App scope.

  Why this is correct

  Creating a policy exemption at the Prod-Sub or RG-App scope is the correct remediation because exemptions are scoped to specific resources, resource groups, or subscriptions and instruct Azure Policy to skip evaluation for those resources while the policy assignment remains intact and enforced everywhere else. When you create the exemption, you must select an exemption category (Waiver or Mitigated) and can optionally set an expiration date, which provides audit traceability for why the deployment is allowed. This preserves the original Deny effect for all other child scopes of Corp-MG, so the broader governance model is maintained without weakening security or compliance posture.

• ✗

  Change the policy effect from Deny to Audit for all assignments.

  Why it's wrong here

  Changing the policy effect from Deny to Audit for all assignments is incorrect because it globally relaxes enforcement across every child scope, not just the production subscription. With the Audit effect, non-compliant resources are allowed to be created or updated and only recorded in the activity log, which means the policy still reports non-compliance but does not actively block deployment. This approach weakens the entire organization's security baseline and contradicts the original intent of the Deny policy. The goal is to permit one exception while keeping denial in place for all other scopes, so altering the effect at the assignment level is too broad and would require an unnecessary separate assignment per scope if you wanted to maintain Deny elsewhere.

  When this WOULD be correct

  If the question required a temporary relaxation of the policy for all resources (e.g., during a migration window) and explicitly stated that weakening enforcement organization-wide is acceptable, then changing the effect to Audit would be correct.

• ✗

  Move Prod-Sub out of Corp-MG.

  Why it's wrong here

  Moving Prod-Sub out of Corp-MG is not a valid solution because a management group hierarchy is the container for governance, compliance, and cost management. Relocating the subscription would detach it from the policies, RBAC role assignments, and budget controls inherited from Corp-MG, potentially breaking its compliance framework and leaving it without the organization's baseline security guardrails. This action creates a structural change with side effects like losing inherited policy assignments and audit logging continuity, and it is an administrative burden for what should be a simple deployment exception. The correct approach is to keep the subscription in place and use a policy exemption at the production subscription or resource group scope to bypass the Deny effect for this particular case.

  When this WOULD be correct

  If the question stated that a subscription should no longer be subject to any policies from a management group (e.g., due to a change in compliance requirements or organizational restructuring), moving it out of the management group would be correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question