An enterprise organization creates a dedicated resource group named rg-production to host critical workloads. The security team establishes two governance requirements for this resource group: Grant the cloud operations team permission to manage all resources within rg-production without giving them access to the rest of the subscription. Enforce an organizational rule that automatically prevents anyone from deploying resources into unapproved geographic regions within rg-production. Which combination of Azure management features should be applied at the resource group scope to satisfy both requirements?

Assign Azure Role-Based Access Control (Azure RBAC) roles for access management, and assign Azure Policy definitions for region restrictions.: What the Solution Is Azure Role-Based Access Control (Azure RBAC) and Azure Policy are core governance and security mechanisms in Microsoft Azure that operate at various scopes, including management groups, subscriptions, resource groups, and individual resources. How It Meets the Requirements Requirement 1 (Scoped User Access): Assigning an Azure RBAC role (such as Contributor) at the resource group scope (rg-production) gives the cloud operations team the necessary administrative rights over the resources inside that specific group without granting unnecessary elevated access across the broader subscription. Requirement 2 (Enforcing Region Standards): Assigning an Azure Policy definition (such as the built-in Allowed locations policy) directly to rg-production evaluates resource deployment requests against predefined business rules. If a user attempts to deploy a resource outside the allowed regions, Azure Policy with a Deny effect blocks the deployment, regardless of the user's RBAC role. Key Advantages and Capabilities Separation of Concerns: Azure RBAC focuses on user actions (who can do what), while Azure Policy focuses on resource properties (what configurations and states are allowed). Scope Inheritance: Both permissions and policies assigned at the resource group level automatically apply to all child resources within that resource group. Guardrail Enforcement: Azure Policy prevents unauthorized resource configurations even if a user holds high-privilege RBAC roles like Owner or Contributor. Granular Least Privilege: Scoping RBAC assignments to a single resource group avoids subscription-wide privilege escalation. Why This Is Optimal Combining Azure RBAC and Azure Policy delivers comprehensive governance by ensuring that authorized users have the exact permissions they need while remaining constrained by mandatory organizational compliance guardrails.

Azure RBAC and Policy for Resource Group Governance

Controlling Resource Group Access with RBAC and Policy

An enterprise organization creates a dedicated resource group named rg-production to host critical workloads. The security team establishes two governance requirements for this resource group:

Grant the cloud operations team permission to manage all resources within rg-production without giving them access to the rest of the subscription.
Enforce an organizational rule that automatically prevents anyone from deploying resources into unapproved geographic regions within rg-production.

Which combination of Azure management features should be applied at the resource group scope to satisfy both requirements?

Assign Azure Advisor recommendations for access management, and assign Azure Resource Locks for region restrictions.

Assign Azure Role-Based Access Control (Azure RBAC) roles for access management, and assign Azure Policy definitions for region restrictions.

Assign Azure Role-Based Access Control (Azure RBAC) roles for region restrictions, and assign Microsoft Entra Conditional Access for resource group permissions.

Assign Azure Resource Locks for access management, and assign Azure Policy definitions for region restrictions.

Explanations

Assign Azure Advisor recommendations for access management, and assign Azure Resource Locks for region restrictions.

What the Option Is

Azure Advisor is a personalized cloud consultant that analyzes resource configurations and usage telemetry to provide actionable recommendations for cost optimization, security, reliability, operational excellence, and performance.

Why It Doesn't Meet the Requirement

Azure Advisor is an advisory tool that provides post-deployment recommendations; it cannot assign administrative permissions or manage user access.
Azure Resource Locks protect resources against deletion or modification, but they have no capability to enforce geographic region deployment policies.

Key Characteristics and Limitations

Advisory only: Azure Advisor does not enforce rules or manage authorization scopes.
No proactive blocking: Advisor recommendations appear after resources are analyzed, rather than blocking non-compliant deployment requests.
Locks do not govern locations: Resource Locks cannot validate or restrict the Azure region in which a resource is created.

This Answer Would Be Correct If

The organization wanted an automated tool to suggest cost savings and security improvements across existing workloads.

Additional Context

Neither Azure Advisor nor Resource Locks can satisfy the requirements of granting scoped permissions to a team and restricting resource deployment regions.

View source documentation

Assign Azure Role-Based Access Control (Azure RBAC) roles for access management, and assign Azure Policy definitions for region restrictions.

What the Solution Is

Azure Role-Based Access Control (Azure RBAC) and Azure Policy are core governance and security mechanisms in Microsoft Azure that operate at various scopes, including management groups, subscriptions, resource groups, and individual resources.

How It Meets the Requirements

Requirement 1 (Scoped User Access): Assigning an Azure RBAC role (such as Contributor) at the resource group scope (rg-production) gives the cloud operations team the necessary administrative rights over the resources inside that specific group without granting unnecessary elevated access across the broader subscription.
Requirement 2 (Enforcing Region Standards): Assigning an Azure Policy definition (such as the built-in Allowed locations policy) directly to rg-production evaluates resource deployment requests against predefined business rules. If a user attempts to deploy a resource outside the allowed regions, Azure Policy with a Deny effect blocks the deployment, regardless of the user's RBAC role.

Key Advantages and Capabilities

Separation of Concerns: Azure RBAC focuses on user actions (who can do what), while Azure Policy focuses on resource properties (what configurations and states are allowed).
Scope Inheritance: Both permissions and policies assigned at the resource group level automatically apply to all child resources within that resource group.
Guardrail Enforcement: Azure Policy prevents unauthorized resource configurations even if a user holds high-privilege RBAC roles like Owner or Contributor.
Granular Least Privilege: Scoping RBAC assignments to a single resource group avoids subscription-wide privilege escalation.

Why This Is Optimal

Combining Azure RBAC and Azure Policy delivers comprehensive governance by ensuring that authorized users have the exact permissions they need while remaining constrained by mandatory organizational compliance guardrails.

View source documentation

Assign Azure Role-Based Access Control (Azure RBAC) roles for region restrictions, and assign Microsoft Entra Conditional Access for resource group permissions.

What the Option Is

Microsoft Entra Conditional Access is an identity-driven security feature that evaluates signals (such as user location, device compliance, and risk level) to enforce access policies like Multi-Factor Authentication (MFA) during user sign-in.

Why It Doesn't Meet the Requirement

Azure RBAC controls user permissions on management operations, but it does not evaluate resource configuration properties, such as restricting specific deployment regions.
Conditional Access governs authentication and sign-in conditions to applications and the Azure management portal, but it cannot assign resource-level management permissions (such as Contributor or Reader) to individual Azure resource groups.

Key Characteristics and Limitations

RBAC handles authorization: RBAC determines what actions an identity can execute on Azure resources, not geographic deployment restrictions.
Conditional Access operates at authentication time: It checks identity signals during login rather than managing Resource Manager scopes.
Azure Policy handles compliance: Region enforcement must be configured through policy definitions in Azure Policy.

This Answer Would Be Correct If

The requirement was to enforce multi-factor authentication (MFA) when administrators log into the Azure portal from untrusted networks.

Additional Context

Confusing RBAC with policy enforcement is a common misconception; RBAC is about user actions, whereas Azure Policy is about resource state.

View source documentation

Assign Azure Resource Locks for access management, and assign Azure Policy definitions for region restrictions.

What the Option Is

Azure Resource Locks are safeguards used to prevent accidental deletion or modification of critical Azure resources, regardless of a user's RBAC role permissions.

Why It Doesn't Meet the Requirement

Resource Locks provide only two settings: CanNotDelete (read/modify allowed, delete blocked) and ReadOnly (read-only access).
They cannot grant, delegate, or manage granular user permissions for specific teams or individuals. Access management requires Azure RBAC to assign specific roles (e.g., Reader, Contributor) to users and security groups.

Key Characteristics and Limitations

Not an authorization tool: Resource locks do not assign permissions to identities.
Applies universally: A lock applies to all users who have access to the resource, including subscription Owners.
Binary protection: Locks are designed solely to prevent deletion or unauthorized modification of existing resources.

This Answer Would Be Correct If

The organization already had user permissions configured and wanted to prevent authorized administrators from accidentally deleting resources within rg-production.

Additional Context

While Azure Policy is correctly identified for region restrictions, Resource Locks cannot replace RBAC for assigning operational duties.

View source documentation

Last updated August 27, 2026Validated August 27, 2026

Controlling Resource Group Access with RBAC and Policy

An enterprise organization creates a dedicated resource group named rg-production to host critical workloads. The security team establishes two governance requirements for this resource group:

Grant the cloud operations team permission to manage all resources within rg-production without giving them access to the rest of the subscription.
Enforce an organizational rule that automatically prevents anyone from deploying resources into unapproved geographic regions within rg-production.

Which combination of Azure management features should be applied at the resource group scope to satisfy both requirements?

Assign Azure Advisor recommendations for access management, and assign Azure Resource Locks for region restrictions.

Assign Azure Role-Based Access Control (Azure RBAC) roles for access management, and assign Azure Policy definitions for region restrictions.

Assign Azure Role-Based Access Control (Azure RBAC) roles for region restrictions, and assign Microsoft Entra Conditional Access for resource group permissions.

Assign Azure Resource Locks for access management, and assign Azure Policy definitions for region restrictions.

Explanations

Assign Azure Advisor recommendations for access management, and assign Azure Resource Locks for region restrictions.

What the Option Is

Why It Doesn't Meet the Requirement

Azure Advisor is an advisory tool that provides post-deployment recommendations; it cannot assign administrative permissions or manage user access.
Azure Resource Locks protect resources against deletion or modification, but they have no capability to enforce geographic region deployment policies.

Key Characteristics and Limitations

Advisory only: Azure Advisor does not enforce rules or manage authorization scopes.
No proactive blocking: Advisor recommendations appear after resources are analyzed, rather than blocking non-compliant deployment requests.
Locks do not govern locations: Resource Locks cannot validate or restrict the Azure region in which a resource is created.

This Answer Would Be Correct If

The organization wanted an automated tool to suggest cost savings and security improvements across existing workloads.

Additional Context

Neither Azure Advisor nor Resource Locks can satisfy the requirements of granting scoped permissions to a team and restricting resource deployment regions.

View source documentation

Assign Azure Role-Based Access Control (Azure RBAC) roles for access management, and assign Azure Policy definitions for region restrictions.

What the Solution Is

How It Meets the Requirements

Requirement 1 (Scoped User Access): Assigning an Azure RBAC role (such as Contributor) at the resource group scope (rg-production) gives the cloud operations team the necessary administrative rights over the resources inside that specific group without granting unnecessary elevated access across the broader subscription.
Requirement 2 (Enforcing Region Standards): Assigning an Azure Policy definition (such as the built-in Allowed locations policy) directly to rg-production evaluates resource deployment requests against predefined business rules. If a user attempts to deploy a resource outside the allowed regions, Azure Policy with a Deny effect blocks the deployment, regardless of the user's RBAC role.

Key Advantages and Capabilities

Separation of Concerns: Azure RBAC focuses on user actions (who can do what), while Azure Policy focuses on resource properties (what configurations and states are allowed).
Scope Inheritance: Both permissions and policies assigned at the resource group level automatically apply to all child resources within that resource group.
Guardrail Enforcement: Azure Policy prevents unauthorized resource configurations even if a user holds high-privilege RBAC roles like Owner or Contributor.
Granular Least Privilege: Scoping RBAC assignments to a single resource group avoids subscription-wide privilege escalation.

Why This Is Optimal

View source documentation

Assign Azure Role-Based Access Control (Azure RBAC) roles for region restrictions, and assign Microsoft Entra Conditional Access for resource group permissions.

What the Option Is

Why It Doesn't Meet the Requirement

Azure RBAC controls user permissions on management operations, but it does not evaluate resource configuration properties, such as restricting specific deployment regions.
Conditional Access governs authentication and sign-in conditions to applications and the Azure management portal, but it cannot assign resource-level management permissions (such as Contributor or Reader) to individual Azure resource groups.

Key Characteristics and Limitations

RBAC handles authorization: RBAC determines what actions an identity can execute on Azure resources, not geographic deployment restrictions.
Conditional Access operates at authentication time: It checks identity signals during login rather than managing Resource Manager scopes.
Azure Policy handles compliance: Region enforcement must be configured through policy definitions in Azure Policy.

This Answer Would Be Correct If

The requirement was to enforce multi-factor authentication (MFA) when administrators log into the Azure portal from untrusted networks.

Additional Context

Confusing RBAC with policy enforcement is a common misconception; RBAC is about user actions, whereas Azure Policy is about resource state.

View source documentation

Assign Azure Resource Locks for access management, and assign Azure Policy definitions for region restrictions.

What the Option Is

Azure Resource Locks are safeguards used to prevent accidental deletion or modification of critical Azure resources, regardless of a user's RBAC role permissions.

Why It Doesn't Meet the Requirement

Resource Locks provide only two settings: CanNotDelete (read/modify allowed, delete blocked) and ReadOnly (read-only access).
They cannot grant, delegate, or manage granular user permissions for specific teams or individuals. Access management requires Azure RBAC to assign specific roles (e.g., Reader, Contributor) to users and security groups.

Key Characteristics and Limitations

Not an authorization tool: Resource locks do not assign permissions to identities.
Applies universally: A lock applies to all users who have access to the resource, including subscription Owners.
Binary protection: Locks are designed solely to prevent deletion or unauthorized modification of existing resources.

This Answer Would Be Correct If

The organization already had user permissions configured and wanted to prevent authorized administrators from accidentally deleting resources within rg-production.

Additional Context

While Azure Policy is correctly identified for region restrictions, Resource Locks cannot replace RBAC for assigning operational duties.

View source documentation

Last updated August 27, 2026Validated August 27, 2026

Controlling Resource Group Access with RBAC and Policy

Explanations

Assign Azure Advisor recommendations for access management, and assign Azure Resource Locks for region restrictions.

What the Option Is

Why It Doesn't Meet the Requirement

Key Characteristics and Limitations

This Answer Would Be Correct If

Additional Context

Assign Azure Role-Based Access Control (Azure RBAC) roles for access management, and assign Azure Policy definitions for region restrictions.

What the Solution Is

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Assign Azure Role-Based Access Control (Azure RBAC) roles for region restrictions, and assign Microsoft Entra Conditional Access for resource group permissions.

What the Option Is

Why It Doesn't Meet the Requirement

Key Characteristics and Limitations

This Answer Would Be Correct If

Additional Context

Assign Azure Resource Locks for access management, and assign Azure Policy definitions for region restrictions.

What the Option Is

Why It Doesn't Meet the Requirement

Key Characteristics and Limitations

This Answer Would Be Correct If

Additional Context

Try 10 interactive questions like this one, free

Related questions

Azure Blob Storage

Azure Resource Manager Templates

New-AzResourceGroup Cmdlet

Azure Resource Group

Azure CLI vs Azure PowerShell Syntax

Azure Blob System Properties vs User-Defined Metadata

Controlling Resource Group Access with RBAC and Policy

Explanations

Assign Azure Advisor recommendations for access management, and assign Azure Resource Locks for region restrictions.

What the Option Is

Why It Doesn't Meet the Requirement

Key Characteristics and Limitations

This Answer Would Be Correct If

Additional Context

Assign Azure Role-Based Access Control (Azure RBAC) roles for access management, and assign Azure Policy definitions for region restrictions.

What the Solution Is

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Assign Azure Role-Based Access Control (Azure RBAC) roles for region restrictions, and assign Microsoft Entra Conditional Access for resource group permissions.

What the Option Is

Why It Doesn't Meet the Requirement

Key Characteristics and Limitations

This Answer Would Be Correct If

Additional Context

Assign Azure Resource Locks for access management, and assign Azure Policy definitions for region restrictions.

What the Option Is

Why It Doesn't Meet the Requirement

Key Characteristics and Limitations

This Answer Would Be Correct If

Additional Context

Try 10 interactive questions like this one, free

Related questions

Azure Blob Storage

Azure Resource Manager Templates

New-AzResourceGroup Cmdlet

Azure Resource Group

Azure CLI vs Azure PowerShell Syntax

Azure Blob System Properties vs User-Defined Metadata