You have an Azure subscription. You plan to create a storage account named storage1. You need to configure a deny assignment for storage1. What should you use?

The correct answer is D. an Azure Resource Manager (ARM) template. The only way to create a deny assignment is through Azure blueprints, and this can only be done when the resource is created. The resource locks protecting against other subscription Owners cannot be applied to existing resources, only new ones. Deny assignments block users…

Submitted by jakub_pl· Mar 4, 2026Manage identities and governance

Question

You have an Azure subscription. You plan to create a storage account named storage1. You need to configure a deny assignment for storage1. What should you use?

Options

AAzure Policy
Ba landing zone
Ca deployment stack
Dan Azure Resource Manager (ARM) template

How the community answered

(21 responses)

A
5% (1)
B
5% (1)
D
90% (19)

Explanation

The only way to create a deny assignment is through Azure blueprints, and this can only be done when the resource is created. The resource locks protecting against other subscription Owners cannot be applied to existing resources, only new ones. Deny assignments block users from performing specific Azure resource actions even if a role assignment grants them access. But you need add this protection in the blueprint definitions of resources created by an Azure Resource Manager template artifact, and the Blueprint resource lock is set during blueprint assignment. https://learn.microsoft.com/en-us/answers/questions/1108981/deny-assignment

Community Discussion

No community discussion yet for this question.

Full AZ-104 Practice