Azure Policy vs RBAC: which controls what?

The classic AZ-900 mix-up. RBAC governs who can act; Azure Policy governs what is allowed. Six questions on the distinctions the exam tests, 2026 edition.

Try 6 free Azure Policy-versus-RBAC questions in the exam's own style — every answer explained, no sign-up — part of our 300-question bank.

Straight to the 6 free questions ↓

If you remember one thing before the exam, remember this: RBAC governs who can act; Azure Policy governs what is allowed. They are complementary tools, not two ways of doing the same job — and the AZ-900 exam loves to see whether you can tell them apart.

The one distinction that matters

Role-based access control (RBAC) is about identities and permissions. You take a user, group, or service identity, give it a role (Owner, Contributor, Reader, or a resource-specific role), and apply that at a scope — a management group, subscription, resource group, or single resource. The result: that identity can now do certain things there. RBAC never cares what the resource looks like, only who is allowed to touch it.

Azure Policy is about rules on the resources themselves. A policy says things like “resources may only be created in West Europe,” “every resource must have a CostCenter tag,” or “only these VM SKUs are allowed.” Azure Policy evaluates each resource for compliance and can deny the ones that break the rule — and it does so regardless of who is acting. An Owner with full permissions is still stopped by a Deny policy.

The diagram above lays this out as two columns meeting at a shared base: the left column, RBAC, runs identity to role to scope; the right column, Azure Policy, runs rule to resource compliance. Both point down at the same Azure resources — which is exactly why beginners confuse them. Same resources, different questions.

Why the exam keeps testing it

The mix-up is easy to trigger because both features live in the governance space and both “control” things. The exam probes the seam with scenarios:

“Let a user manage VMs” — a permission for a person → RBAC.
“Allow resources only in certain regions” — a rule on resources → Azure Policy.
“Require a tag on every resource” — a configuration rule → Azure Policy.
“Give read-only access to a resource group” — a permission for a person → RBAC.
“Deny creating a resource type” — a rule that holds for everyone → Azure Policy.

Read each scenario for the subject. If the sentence is about a person, user, group, or role, it is RBAC. If it is about which resources, regions, tags, or SKUs are permitted, it is Azure Policy.

When you need both

Real governance almost always uses the two together, and the exam has at least one “both” answer waiting for you. A common pattern: use RBAC to grant the storage team permission to manage storage accounts, and use Azure Policy to make sure any account they create uses an approved SKU and lives in an approved region. RBAC opens the door; Policy sets the house rules once you are inside. Picking only one when the scenario clearly needs both is the trap.

The shortcut to carry in

Answer each question below before you reveal the explanation, and when you miss, read past the correct option to why the others are wrong — the distractors here are usually the right tool aimed at the wrong question. One memory hook does most of the work:

RBAC = who, Policy = what.

Say it once and the whole comparison snaps into place. For the wider governance picture, see the management and governance domain and the identity and governance summary.

Two columns meeting at a shared base. The left column, RBAC, answers who can act: an identity such as a user or group is granted a role that carries permissions, applied at a scope like a subscription or resource group. The right column, Azure Policy, answers what is allowed: a rule such as allowed regions, required tags, or allowed SKUs evaluates each resource for compliance and can deny non-conforming ones. Both columns point down to a shared Azure resources base, showing the two controls work together on the same resources.

6 free AZ-900 practice questions

Answers and explanations — no email wall

AZ-900 Question 1 of 6

You need to let a user create and manage virtual machines in a resource group. Which Azure feature do you use?

Answer: A — Role-based access control (RBAC) — assign the user a role at that scope

Granting a person permission to do something is exactly what RBAC does: you assign a role (such as Virtual Machine Contributor) to the identity at a scope. Why not the others: Azure Policy never grants permissions — it decides which resources and configurations are allowed, not who may act. A resource lock only prevents deletion or changes; it does not grant management rights. A management group is a container for organising subscriptions, not a way to give one user access. Pro tip: RBAC = who, Policy = what.

AZ-900 Question 2 of 6

Your organisation requires that resources be created only in specific Azure regions. Which service enforces this?

Answer: A — Azure Policy — restrict allowed locations so non-conforming resources are denied

Restricting which regions resources may be deployed to is a rule about the resource itself, so it is Azure Policy's job — the built-in 'Allowed locations' policy denies anything outside the list. Why not the others: RBAC controls who can act, not where resources are allowed to live, and roles are not region-limited this way. Entra ID conditional access governs sign-in, not resource placement. A budget tracks spending and alerts; it does not block a region. Pro tip: RBAC = who, Policy = what.

AZ-900 Question 3 of 6

Every resource in your subscription must carry a 'CostCenter' tag. Which Azure feature makes this a rule?

Answer: A — Azure Policy — require the tag and flag or deny resources that lack it

Requiring a tag on every resource is an organisational rule about resource configuration, which is precisely what Azure Policy enforces — it can require, append, or deny based on tags. Why not the others: no RBAC role forces users to add tags; roles grant or withhold permissions, not configuration rules. Azure Advisor only suggests improvements; it does not enforce anything. A resource lock blocks deletion or edits, not missing tags. Pro tip: RBAC = who, Policy = what.

AZ-900 Question 4 of 6

A team member needs to view — but not change — everything in a resource group. What do you assign?

Answer: A — The Reader role via RBAC at the resource group scope

Giving a specific person read-only access is an RBAC assignment: the built-in Reader role grants view rights at whatever scope you choose. Why not the others: Azure Policy governs which resources and configurations are allowed — it does not hand a named user read access. Deny assignments are an RBAC concept (used by Azure Blueprints/managed apps), not something Azure Policy issues to grant reading. A management group organises subscriptions; it is not how you give one person read-only rights. Pro tip: RBAC = who, Policy = what.

AZ-900 Question 5 of 6

Your company wants to prevent anyone from creating a particular resource type anywhere in a subscription. Which feature does this?

Answer: A — Azure Policy — a Deny effect on that resource type

Blocking creation of a specific resource type regardless of who tries is a rule about what is allowed, so Azure Policy with a Deny effect is the tool — the rule holds even for owners and administrators. Why not the others: editing RBAC would mean stripping permissions from every identity one by one, and a new user or an admin could still create the resource, so it does not reliably enforce the rule. A resource lock prevents deletion or modification, not creation of a type. Azure Monitor can alert after the fact but cannot prevent the action. Pro tip: RBAC = who, Policy = what.

AZ-900 Question 6 of 6

You must ensure only approved people manage storage AND that any storage they create uses an allowed SKU. Which combination is correct?

Answer: A — RBAC to grant the storage-management permissions, plus Azure Policy to restrict the allowed SKUs

The two halves are different questions: who may manage storage is RBAC, and which SKUs are permitted is Azure Policy, so you use both together — they are complementary, not alternatives. Why not the others: RBAC alone controls access but cannot constrain which SKU a permitted user picks. Azure Policy alone constrains the configuration but never grants anyone the permission to act. A resource lock only blocks deletion or changes and addresses neither requirement. Pro tip: RBAC = who, Policy = what.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 6 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 300 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

300 questions in 6 full tests, AZ-900 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

Can Azure Policy grant a user permissions?

No. Azure Policy only evaluates and enforces rules about which resources and configurations are allowed — allowed regions, required tags, permitted SKUs, denied resource types. Granting a person or group permission to do something is RBAC's job. This split is a favourite AZ-900 distinction: Policy governs what, RBAC governs who.

Do Azure Policy and RBAC overlap?

They work on the same resources but answer different questions, so they complement rather than overlap. RBAC decides who can act on a scope; Azure Policy decides what is allowed there, and it applies to everyone — including owners and administrators. Most real governance setups use both at once, as the diagram above shows.

Are these real AZ-900 exam questions?

No. They are our own questions, written in the style and difficulty of the exam. Reproducing real exam items violates the Microsoft certification agreement and can cost you your certification, and a memorised item teaches you nothing about the next one. Our full bank holds 300 questions across 6 practice tests.

Updated for AZ-900 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.