AZ-900 Describe Azure management and governance Practice Question
Which Azure feature can be used to prevent Azure resources in a subscription from being moved to a different resource group?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Resource Locks (ReadOnly)
Azure Resource Locks can prevent resources from being modified or deleted. A CanNotDelete lock prevents deletion. A ReadOnly lock prevents both modification and deletion — including moving a resource to a different resource group (which is considered a modification operation). Locks are inherited by child resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy deny effect for resource moves
Why it's wrong here
Azure Policy can use the deny effect to prevent the creation or modification of resources that violate compliance rules, such as disallowing a specific location or tag value. However, resource moves are not standard resource property updates; they are ARM lifecycle actions that policy evaluation does not natively intercept for denial in the same way. While custom policy definitions might audit moves, the deny effect is not the designed tool for blocking moves. Resource Locks were created for this exact operational control, making Policy the wrong choice.
- ✓
Azure Resource Locks (ReadOnly)
Why this is correct
A ReadOnly Resource Lock is the correct and definitive mechanism to prevent resource moves. When applied to a resource group or resource, it blocks all write operations, including the action of moving that resource to another resource group. Because the move operation conceptually changes the parent resource group, it is treated as a write and is denied even for users with Owner or Contributor permissions. This is precisely the role-independent, blanket protection the question requires.
- ✗
Azure RBAC without 'move' permissions
Why it's wrong here
Azure RBAC defines *who* can perform actions on Azure resources based on their assigned roles within Microsoft Entra ID. While removing 'move' permissions via RBAC would prevent *specific users* from moving resources, it does not provide a blanket prevention mechanism for *all* users, including those with elevated privileges. The question requires preventing movement *irrespective* of permissions, which RBAC cannot enforce. It is tempting because RBAC *does* control the `Microsoft.Resources/subscriptions/resourceGroups/moveResources/action` permission, making it the correct choice for *delegating* or *restricting* move capabilities for particular identities.
- ✗
Azure Subscription spending limits
Why it's wrong here
Azure Subscription spending limits control the financial exposure of a subscription by establishing a billing threshold that, when reached, disables the subscription to prevent cost overruns. They are entirely unrelated to management-plane operations such as moving resources between resource groups. A spending limit does not block or modify ARM operations; it only stops deployment in response to billing triggers. Therefore, it cannot prevent a resource from being moved.
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.