AZ104-Q: Azure Policy vs RBAC
Q: You need to ensure users cannot create VMs in a disallowed region. Which should you use?
- A) RBAC — remove
Microsoft.Compute/virtualMachines/writefrom Contributors - B) A Conditional Access policy
- C) Azure Policy with a
Denyeffect ✓ - D) A custom availability zone
Answer: C — Azure Policy. RBAC controls who can perform an action (permissions); Azure Policy controls the configuration of resources. Use Policy with the Deny effect bound to a region condition so any VM creation in a disallowed region is blocked for everyone, regardless of permission. Removing a permission via RBAC wouldn’t stop currently-authorized admins and is fragile; Policy is the correct governance mechanism.
Why it helps
Marks the classic AZ-104 boundary: Policy = rules/compliance, RBAC = access. Policy can also Audit, Deny, or DeployIfNotExists.