AZ-104 Manage Azure Identities and Governance Practice Question
A company has three business units. Each business unit needs its own subscription for billing and admin delegation. Corporate security wants one policy assignment to cover all current and future subscriptions in each business unit. What structure should you implement?
⚠ Common exam trap
Candidates often think resource groups are sufficient for isolation and policy enforcement, overlooking that management groups provide subscription-level aggregation and inheritance that resource groups cannot achieve across multiple subscriptions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a management group for each business unit and place that unit's subscriptions underneath it
Management groups allow you to aggregate multiple subscriptions under a single hierarchy, enabling policy assignment at the management group level that applies to all current and future subscriptions within that group. This meets the requirement for per-business-unit billing isolation (via separate subscriptions) and centralized policy enforcement across all subscriptions in each unit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place all resources in one subscription and separate them only by resource group
Why it's wrong here
A single subscription can hold many resources, but a subscription is the primary accounting and quota boundary in Azure; separating business units by resource group alone does not split billing from Azure Cost Management or provide independent subscription-level roles and limits. Resource groups are simply containers for managing the lifecycle of resources (delete, lock, tag, apply RBAC at resource group level), and they cannot enforce separate admin control for each business unit without more restrictive role assignments. This approach also forces all business units to share the same subscription quota limits, making it harder to monitor per-unit costs and separate infrastructure.
When this WOULD be correct
This would be correct if the question required centralized management with no billing separation, and the policy needed to apply to all resources within a single subscription regardless of business unit.
- ✓
Create a management group for each business unit and place that unit's subscriptions underneath it
Why this is correct
Management groups sit above subscriptions in the Azure hierarchy and can contain multiple subscriptions, allowing you to apply Azure Policy (including policy initiatives) and role assignments at the management-group scope, which is inherited by all child subscriptions and their resource groups. Placing each business unit's subscriptions under its own management group gives each unit a consistent governance boundary, supports grouping multiple subscriptions, and still leaves each subscription as its own billing and administrative boundary.
- ✗
Assign the policy at each resource group because policies cannot target subscriptions
Why it's wrong here
The premise is false: Azure Policy supports assignment at management group, subscription, resource group, and individual resource scopes. Assigning at subscription scope is not only allowed but recommended when you want a policy to apply to every resource group and resource within that subscription. Hand-assigning the same policy to each resource group is redundant, error-prone, and bypasses the inheritance that a subscription-scoped assignment provides.
- ✗
Create one resource group per business unit inside a shared subscription
Why it's wrong here
Resource groups are not a billing or administrative boundary; they are organizing containers within a single subscription that cannot split cost reporting or provide an independent security boundary. Because all resource groups in a subscription share the same subscription limits, RBAC at the resource group is limited to that scope and cannot, for example, assign a subscription-wide owner per business unit. Using one subscription with per-unit resource groups also means any operation on the subscription, such as changing directory or billing ownership, affects every business unit simultaneously.
When this WOULD be correct
This would be correct if the question required all business units to share a single subscription and the policy needed to be applied to all resources within that subscription, with resource groups used only for organizational purposes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a management group for each business unit and place that unit's subscriptions underneath itCorrect answer▾
Why this is correct
Management groups sit above subscriptions in the Azure hierarchy and can contain multiple subscriptions, allowing you to apply Azure Policy (including policy initiatives) and role assignments at the management-group scope, which is inherited by all child subscriptions and their resource groups. Placing each business unit's subscriptions under its own management group gives each unit a consistent governance boundary, supports grouping multiple subscriptions, and still leaves each subscription as its own billing and administrative boundary.
✗Place all resources in one subscription and separate them only by resource groupWrong answer — click to see why▾
Why this is wrong here
This option does not meet the requirement for separate subscriptions per business unit, as it uses a single subscription. It also fails to provide a single policy assignment covering all current and future subscriptions because there is only one subscription.
★ When this WOULD be the correct answer
This would be correct if the question required centralized management with no billing separation, and the policy needed to apply to all resources within a single subscription regardless of business unit.
Why candidates choose this
Candidates may think resource groups are sufficient for separation and policy assignment, overlooking the need for distinct subscriptions for billing and admin delegation.
✗Create one resource group per business unit inside a shared subscriptionWrong answer — click to see why▾
Why this is wrong here
This option fails because it does not provide separate subscriptions per business unit for billing and admin delegation, and a single subscription cannot have separate policy assignments for each business unit's resources.
★ When this WOULD be the correct answer
This would be correct if the question required all business units to share a single subscription and the policy needed to be applied to all resources within that subscription, with resource groups used only for organizational purposes.
Why candidates choose this
Candidates may think resource groups can serve as a substitute for subscriptions for policy assignment and delegation, not realizing that policy assignments at the resource group level do not cover future resources in other resource groups or subscriptions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Policy enforcement
Policy enforcement is the process of implementing and ensuring compliance with defined security rules and configurations across an IT environment.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, where should the new subscription be placed so it inherits the production governance baseline automatically?
easy- ✓ A.Place the subscription under Prod-MG.
- B.Place the subscription under Sandbox-MG.
- C.Create a resource group named Finance-Prod instead of assigning a management group.
- D.Move the subscription to the tenant root and assign policies later.
Why A: Placing the new subscription under the Prod-MG management group ensures it automatically inherits the Azure Policy and RBAC assignments applied at that level. Management groups in Azure allow hierarchical governance, and any subscription within a management group inherits policies and role assignments from that group and all parent groups. This enables consistent enforcement of the production governance baseline without manual configuration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.