Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel →hardMultiple ChoiceObjective-mapped
How to Assign a Microsoft Defender for Cloud Policy Initiative to All Subscriptions Using a Management Group
Your organization has multiple Azure subscriptions and uses Microsoft Defender for Cloud. You need to ensure that all subscriptions have a consistent security policy applied. You create a management group containing all subscriptions. What should you do next to assign a Defender for Cloud initiative to all subscriptions?
Quick Answer
The correct next step is to assign the initiative as an Azure Policy at the management group scope. This works because Azure Policy assignments at a management group level automatically inherit down to all child subscriptions, ensuring a consistent Defender for Cloud policy initiative is applied across your entire organization without manual per-subscription configuration. On the Microsoft Azure Security Engineer Associate AZ-500 exam, this scenario tests your understanding of policy inheritance and management group hierarchy—a common trap is thinking you must assign initiatives individually per subscription or use deprecated Azure Blueprints. Remember, assigning at the tenant root is overly broad and not recommended for targeted security baselines. A helpful memory tip: think "MG scope, auto-inherit"—management group scope means one assignment, all subscriptions covered.
⚠ Common exam trap
Many exam-takers confuse Azure Blueprints with Azure Policy inheritance, thinking Blueprints can apply policies across a management group hierarchy, when in fact Blueprints require per-subscription assignment and do not support automatic inheritance like Azure Policy does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the initiative as an Azure Policy at the management group scope.
Assigning the initiative as an Azure Policy at the management group scope is the correct approach because Azure Policy can be applied at the management group, subscription, or resource group level, and it will be inherited by all child subscriptions. This ensures a consistent security policy across all subscriptions without manual per-subscription configuration. Microsoft Defender for Cloud uses Azure Policy initiatives (such as the Microsoft Cloud Security Benchmark) to enforce security controls, and assigning at the management group scope is the most efficient method for bulk compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Azure Blueprints to define the initiative and assign it to the management group.
Why it's wrong here
Incorrect: Azure Blueprints is deprecated; Azure Policy is the recommended approach.
- ✓
Assign the initiative as an Azure Policy at the management group scope.
Why this is correct
Correct: Policy assignment at management group scope applies to all subscriptions under it.
- ✗
Create a custom RBAC role that includes the initiative and assign it to the management group.
Why it's wrong here
Incorrect: RBAC controls permissions, not policy assignment.
- ✗
Assign the initiative to each subscription individually using the Defender for Cloud interface.
Why it's wrong here
Incorrect: Assigning individually is inefficient and not consistent.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization has multiple Azure subscriptions managed by Microsoft Defender for Cloud. You need to ensure that all subscriptions have the same security policies applied, and that any new subscription automatically inherits these policies. What should you do?
medium- A.Create an Azure Blueprint and assign it to each subscription
- B.Assign a policy initiative to a resource group and then move subscriptions into that group
- C.Assign a policy initiative to each subscription individually
- ✓ D.Assign a policy initiative at the management group level
Why D: Assigning a policy initiative at the management group level ensures that all subscriptions within that management group inherit the same security policies. When a new subscription is added to the management group, it automatically receives the assigned initiative, meeting the requirement for consistent and automatic inheritance. This is the most efficient and scalable approach for managing multiple subscriptions in Microsoft Defender for Cloud.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.