AZ-900 Describe Azure management and governance Practice Question
A company has a policy that all Azure resources must have an 'Owner' tag. They want to automatically add the 'Owner' tag with a value 'Default' to any resource created without it. Which Azure Policy effect should they use?
⚠ Common exam trap
Many exam-takers confuse Append with Modify, thinking Modify can also add tags, but Modify is designed for altering existing properties and requires a managed identity, while Append is the correct effect for adding missing fields like tags during resource creation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Append
The Append effect is correct because it allows Azure Policy to add the 'Owner' tag with a value 'Default' to any resource that is created without that tag. Append works by adding specified fields (like tags) to the resource during creation or update, without blocking the operation. This ensures compliance with the tagging policy automatically, without denying the resource creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Append
Why this is correct
The Append effect automatically adds the missing 'Owner' tag to a resource as part of the Azure Resource Manager request during creation or update. It modifies the incoming request before the resource is provisioned, ensuring the tag exists without blocking the operation. This makes it the exact tool for enforcing a 'must have an owner tag' policy from the start.
- ✗
Modify
Why it's wrong here
The Modify effect is incorrect here because, while it can add or update tags, its primary use is for applying changes to existing resources through remediation tasks, or for enforcing specific values rather than simply adding a missing tag during creation. It's tempting because it can manipulate tags, and for new resources, it can append tags if they are missing. However, the Append effect is specifically designed for the scenario of automatically adding a missing tag or value to a resource *during* its creation request, ensuring it exists before the resource is provisioned.
When this WOULD be correct
Modify would be correct if the policy needed to add or change tags on existing resources that were already created without the required tag, and the policy should trigger remediation tasks to fix non-compliant resources.
- ✗
Deny
Why it's wrong here
The Deny effect evaluates the resource against the policy and, if the 'Owner' tag is missing, it rejects the creation request entirely, causing the deployment to fail. It does not add the tag; rather, it stops non-compliant resources from being created. Using Deny would force users to manually provide the tag, but it would not satisfy the stated requirement to automatically add the tag as part of the policy.
When this WOULD be correct
If the policy required that all resources must have an 'Owner' tag and any resource created without it should be rejected (not created), then Deny would be the correct effect.
- ✗
Audit
Why it's wrong here
The Audit effect only triggers a warning event in the activity log when a resource lacks the 'Owner' tag, but it allows the resource to be created anyway. It performs no modification and provides no enforcement, merely flagging non-compliance for later review. Therefore, it cannot ensure that all resources have the tag; it only tells you when they do not.
When this WOULD be correct
A question where the requirement is to log non-compliant resources for reporting or monitoring purposes, without automatically remediating them. For example: 'A company wants to identify all resources missing an 'Owner' tag for manual review.'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓AppendCorrect answer▾
Why this is correct
The Append effect automatically adds the missing 'Owner' tag to a resource as part of the Azure Resource Manager request during creation or update. It modifies the incoming request before the resource is provisioned, ensuring the tag exists without blocking the operation. This makes it the exact tool for enforcing a 'must have an owner tag' policy from the start.
✗ModifyWrong answer — click to see why▾
Why this is wrong here
Modify effect is used to add or alter tags on existing resources, but it cannot be used to add tags during resource creation. The question requires automatically adding the tag at creation time, which Append does by adding the tag to the resource request before creation.
★ When this WOULD be the correct answer
Modify would be correct if the policy needed to add or change tags on existing resources that were already created without the required tag, and the policy should trigger remediation tasks to fix non-compliant resources.
Why candidates choose this
Candidates may confuse Modify with Append because both can add tags, but Modify is designed for altering existing resources and supports remediation, while Append works during creation or update of a resource.
✗DenyWrong answer — click to see why▾
Why this is wrong here
Deny prevents creation of resources that don't comply with the policy, but the requirement is to automatically add the missing tag, not to block resource creation.
★ When this WOULD be the correct answer
If the policy required that all resources must have an 'Owner' tag and any resource created without it should be rejected (not created), then Deny would be the correct effect.
Why candidates choose this
Candidates may confuse 'Deny' with 'Append' because both enforce tagging, but Deny blocks non-compliant resources while Append fixes them automatically.
✗AuditWrong answer — click to see why▾
Why this is wrong here
The Audit effect only logs non-compliance without taking any action to add the missing tag, so it does not automatically add the 'Owner' tag with a default value.
★ When this WOULD be the correct answer
A question where the requirement is to log non-compliant resources for reporting or monitoring purposes, without automatically remediating them. For example: 'A company wants to identify all resources missing an 'Owner' tag for manual review.'
Why candidates choose this
Candidates may confuse Audit with a corrective action, thinking that auditing will somehow enforce the tag, or they may not fully understand that Audit is only for logging compliance status.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Tag
A tag is a metadata label attached to a cloud resource or IT asset to organize, track, and manage it based on custom attributes like environment, owner, or cost center.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.