Azure AZ-104: Manage Azure identities and governance Practice Questions

The 'Modify' effect is specifically designed to add, update, or change properties on existing resources (such as enabling HTTPS-only), making it ideal for remediating non-compliant storage accounts automatically. Assigning it at the Tenant Root Group scope ensures it applies to all subscriptions in the entire hierarchy with a single assignment. The managed identity must have appropriate permissions (Storage Account Contributor) to perform modifications. Audit only reports non-compliance without remediation. Deny prevents new non-compliant resources but does not remediate existing ones — and using a separate script adds administrative effort. DeployIfNotExists is used to deploy related/child resources, not to modify a property on the resource itself; assigning it at each subscription scope also violates the least-effort requirement.

While the question may seem billing-focused, within the AZ-104 scope the correct governance approach is to place all three subscriptions under a single management group. Management groups allow unified cost analysis and policy governance across subscriptions. A single EA billing account consolidates invoicing at the billing level, but within Cost Management, management groups provide the scoping mechanism for aggregated cost views available to AZ-104 administrators. Azure Reservations provide discounted pricing but do not consolidate invoices or cost views. Azure Lighthouse is for cross-tenant management delegation, not subscription cost consolidation within the same tenant.

A ReadOnly lock prevents any write or delete operations, regardless of RBAC permissions — even the Owner role cannot override a resource lock. Reading resources (listing them) is a read operation and is explicitly allowed by a ReadOnly lock. Deleting a VM is a delete operation and is blocked. Creating a new storage account is a write operation and is blocked. Moving a resource is treated as both a write on the source and destination resource groups, so it is also blocked by the ReadOnly lock.

Azure Cost Management budgets support two alert condition types: 'Actual' (triggers when real spend crosses the threshold) and 'Forecasted' (triggers when projected spend is predicted to cross the threshold). Setting an Actual alert at 80% covers the first requirement, and a Forecasted alert at 100% covers the second. An Actual alert at 100% would only fire after the budget is already exceeded, which is not what was asked. A Forecasted alert at 80% is not required and doesn't match the stated requirements. Cost Anomaly alerts are a separate feature in Cost Management and are not budget alert thresholds.

User Administrator grants the ability to create/delete users, reset passwords for non-admins, and manage groups, which matches all stated requirements. Global Administrator has far broader permissions (including managing all aspects of Entra ID and Azure AD-integrated services) and violates the principle of least privilege. License Administrator can manage licenses but cannot create or delete users or manage groups. Helpdesk Administrator can reset passwords and manage service requests but cannot create or delete user accounts or manage group memberships.