How to Automatically Apply Governance Baseline to New Subscriptions
A company creates new Azure subscriptions every month. Central IT wants all production subscriptions to inherit the same governance baseline automatically, while sandbox subscriptions remain separate. What should the administrator implement?
Quick Answer
The answer is to organize subscriptions under management groups and assign the governance baseline at the appropriate management group. This works because management groups create a hierarchical structure above subscriptions, allowing Azure Policy and RBAC assignments to flow down via automatic inheritance. When you place all production subscriptions under a dedicated management group and assign the baseline—such as an Azure Policy initiative—any new subscription added to that group instantly inherits the rules, while sandbox subscriptions remain unaffected in a separate group. On the AZ-104 exam, this tests your understanding of governance at scale, often appearing in scenario-based questions where you must choose between assigning policies at the subscription versus management group level. A common trap is trying to assign policies individually to each new subscription, which defeats automation. Remember the memory tip: “Group to govern, inherit to automate”—if you want automatic inheritance, always assign at the management group, not the subscription.
⚠ Common exam trap
Watch out — candidates often confuse resource locks (which protect against accidental deletion/modification) with governance baselines (which enforce compliance via Azure Policy), leading candidates to incorrectly select resource locks as a solution for automatic policy inheritance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Organize subscriptions under management groups and assign the baseline at the appropriate management group.
Management groups allow hierarchical organization of Azure subscriptions, enabling the assignment of Azure Policy and RBAC at the management group level. By placing all production subscriptions under a dedicated management group and assigning the governance baseline (e.g., Azure Policy initiatives) to that group, new subscriptions automatically inherit the baseline without manual intervention. Sandbox subscriptions remain separate by being placed in a different management group or at the root level without the baseline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply all governance controls individually to each new subscription after it is created.
Why it's wrong here
This is operationally expensive and risks inconsistent configuration as subscriptions grow.
When this WOULD be correct
If the question specified that subscriptions are created infrequently and each has unique governance requirements that cannot be standardized, then manual per-subscription assignment would be appropriate.
- ✓
Organize subscriptions under management groups and assign the baseline at the appropriate management group.
Why this is correct
Management groups provide inheritance so new subscriptions automatically receive the assigned governance controls.
- ✗
Use a resource lock on the subscription root.
Why it's wrong here
Locks are not designed for hierarchical organization or for enforcing a reusable governance baseline.
When this WOULD be correct
An administrator needs to prevent accidental deletion of a critical subscription that contains production resources. The correct answer would be to apply a CanNotDelete resource lock at the subscription level.
- ✗
Place all resources into one shared resource group per business unit.
Why it's wrong here
Resource groups are too narrow for subscription-level governance and do not solve subscription inheritance.
When this WOULD be correct
If the question required simplifying resource management within a single subscription by grouping related resources for cost tracking or role-based access control, then placing resources into one shared resource group per business unit would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Organize subscriptions under management groups and assign the baseline at the appropriate management group.Correct answer▾
Why this is correct
Management groups provide inheritance so new subscriptions automatically receive the assigned governance controls.
✗Apply all governance controls individually to each new subscription after it is created.Wrong answer — click to see why▾
Why this is wrong here
Applying governance controls individually to each new subscription is not automated and does not scale, failing to meet the requirement that all production subscriptions inherit the baseline automatically.
★ When this WOULD be the correct answer
If the question specified that subscriptions are created infrequently and each has unique governance requirements that cannot be standardized, then manual per-subscription assignment would be appropriate.
Why candidates choose this
Candidates may think manual assignment ensures precise control, overlooking the need for automation and inheritance at scale.
✗Use a resource lock on the subscription root.Wrong answer — click to see why▾
Why this is wrong here
A resource lock prevents accidental deletion or modification of a subscription, but it does not enforce governance baselines like policies or RBAC across multiple subscriptions. It cannot automatically inherit settings to new subscriptions.
★ When this WOULD be the correct answer
An administrator needs to prevent accidental deletion of a critical subscription that contains production resources. The correct answer would be to apply a CanNotDelete resource lock at the subscription level.
Why candidates choose this
Candidates may confuse resource locks with governance controls, thinking they can enforce compliance, or they may overestimate the scope of locks as a management tool.
✗Place all resources into one shared resource group per business unit.Wrong answer — click to see why▾
Why this is wrong here
Placing all resources into one shared resource group per business unit does not automatically inherit governance baselines across subscriptions; it only groups resources within a single subscription, failing to address the requirement for automatic inheritance across multiple production subscriptions.
★ When this WOULD be the correct answer
If the question required simplifying resource management within a single subscription by grouping related resources for cost tracking or role-based access control, then placing resources into one shared resource group per business unit would be correct.
Why candidates choose this
Candidates may think that grouping resources by business unit ensures consistent governance, but they overlook that resource groups do not enforce policies across subscriptions or provide automatic inheritance.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has 18 Azure subscriptions. Production subscriptions must inherit stricter governance than sandbox subscriptions, and central IT wants one place to target future policy assignments to each group. What should the administrator do?
medium- ✓ A.Create management groups for Prod and Sandbox, then move subscriptions into them
- B.Create resource groups named Prod and Sandbox in each subscription
- C.Use tags on subscriptions to separate production from sandbox
- D.Apply a CanNotDelete lock to each subscription
Why A: Management groups allow you to organize Azure subscriptions hierarchically and apply Azure Policy and role-based access control (RBAC) at the management group level, which is inherited by all subscriptions within that group. By creating separate management groups for Prod and Sandbox and moving the respective subscriptions into them, central IT can assign policy assignments once to each management group, ensuring stricter governance for production subscriptions and a lighter touch for sandbox subscriptions.
Variation 2. New Azure subscriptions are created every month. Production subscriptions require stricter governance than sandbox subscriptions, and central IT wants those rules to apply automatically to any future production subscription without reconfiguring each one. What should they set up?
medium- A.Separate resource groups for production and sandbox workloads in each subscription.
- ✓ B.A management group hierarchy with production and sandbox child management groups, then assign governance at the appropriate scope.
- C.A CanNotDelete lock on each subscription.
- D.A custom role assigned to each subscription owner.
Why B: Management groups allow you to build a hierarchy that reflects your organizational structure and apply governance policies (e.g., Azure Policy, RBAC) at the management group scope. By creating a 'Production' child management group under the root, any new subscription placed in that group automatically inherits the assigned policies and role assignments, eliminating the need to reconfigure each subscription individually.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.