An enterprise has 30 Azure subscriptions. Production subscriptions need a common baseline of allowed regions, required tags, and approved SKU rules, and any new production subscription must inherit those rules automatically. Sandbox subscriptions should follow a separate, lighter baseline. Which Azure construct should the team use to organize this governance model?

A separate resource group for each business unit inside every subscription.

Resource groups do not provide cross-subscription inheritance or governance boundaries at the enterprise level.

A set of resource locks applied directly to critical resources in each subscription.

Locks protect individual resources from changes or deletion, but they do not organize subscriptions or inherit policy.

A single policy exemption applied at the tenant root.

An exemption removes enforcement for a scope; it does not create separation between production and sandbox governance.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: A management group hierarchy with separate production and sandbox branches. — Management groups are the correct construct when governance must flow across multiple subscriptions with inheritance. By placing production and sandbox subscriptions into different branches, central IT can assign baseline policies and controls once and have them apply automatically to current and future subscriptions beneath each branch. This provides administrative boundaries, consistent compliance, and simpler change management than trying to duplicate configuration per subscription or per resource group. Why others are wrong: Resource groups are too small in scope and cannot provide enterprise-wide inheritance across subscriptions. Resource locks only protect individual resources from deletion or modification; they do not define organizational hierarchy. A tenant-level exemption would weaken governance instead of separating production from sandbox behavior. The requirement is about structural governance inheritance, which is exactly the role of management groups.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.