AZ-900 Describe Azure management and governance Practice Question
A company has 10 Azure subscriptions organized under two management groups: Production and Non-Production. The governance team needs to enforce a policy that all Azure resources must be deployed only in the East US or West US Azure regions. The policy must apply to every subscription under both management groups, including any new subscriptions added in the future, without requiring separate assignments per subscription. Which Azure feature should the team use to achieve this with the least administrative effort?
⚠ Common exam trap
Watch out — candidates often think per-subscription assignment is required for granular control, overlooking the inheritance capability of management groups that allows a single assignment at the root to cover all current and future subscriptions with minimal effort.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the 'Allowed Locations' Azure Policy definition to the root management group.
Assigning the 'Allowed Locations' Azure Policy definition to the root management group ensures the policy is inherited by all child management groups (Production and Non-Production) and all subscriptions under them, including any new subscriptions added in the future. This approach requires only a single assignment and minimizes administrative effort compared to per-subscription assignments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the 'Allowed Locations' Azure Policy definition to each individual subscription.
Why it's wrong here
Assigning the policy to each subscription individually is possible but requires 10 separate assignments (and more if new subscriptions are added). This increases administrative overhead and does not automatically cover new subscriptions. Azure Policy supports assignment at management group scope to simplify inheritance.
When this WOULD be correct
If the requirement was to apply the policy only to specific subscriptions (e.g., a subset of subscriptions under a management group) and not to all subscriptions or future ones, then assigning the policy individually to those subscriptions would be correct.
- ✓
Assign the 'Allowed Locations' Azure Policy definition to the root management group.
Why this is correct
Assigning the policy to the root management group applies the policy to all subscriptions under that group (including both Production and Non-Production). Any new subscriptions added to the hierarchy automatically inherit the policy. This is the most efficient method.
- ✗
Create a custom Azure RBAC role that restricts the region property and assign it to all users.
Why it's wrong here
Azure RBAC roles grant or deny permissions for specific management operations (e.g., Microsoft.Resources/subscriptions/resourceGroups/write) and cannot enforce constraints on resource property values such as deployment location. Location restrictions are implemented by Azure Policy, which evaluates resource properties at create or update time and denies non-compliant deployments. Even a custom RBAC role cannot inspect or restrict the 'location' property because location is an input parameter to a deployment, not an RBAC action. Thus, this approach would still allow users with write permission to deploy to any region, leaving the compliance requirement unmet.
When this WOULD be correct
A question where the requirement is to restrict which users can create resources in certain regions, such as 'Only the security team can deploy resources to the East US region.' In that case, a custom RBAC role with a deny assignment for other regions would be appropriate.
- ✗
Apply an Azure Resource Manager read-only lock to each subscription.
Why it's wrong here
Azure Resource Manager locks (ReadOnly or CanNotDelete) prevent deletion or modification of resources but do not restrict the regions where resources can be created. Locks are used for protecting resources, not for enforcing compliance rules like allowed locations.
When this WOULD be correct
A company needs to prevent accidental deletion or modification of critical resources across multiple subscriptions. Applying a read-only lock at the subscription level ensures that no resources in those subscriptions can be changed or removed without first removing the lock.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign the 'Allowed Locations' Azure Policy definition to the root management group.Correct answer▾
Why this is correct
Assigning the policy to the root management group applies the policy to all subscriptions under that group (including both Production and Non-Production). Any new subscriptions added to the hierarchy automatically inherit the policy. This is the most efficient method.
✗Assign the 'Allowed Locations' Azure Policy definition to each individual subscription.Wrong answer — click to see why▾
Why this is wrong here
Assigning the policy to each individual subscription requires separate assignments per subscription and does not automatically apply to new subscriptions, increasing administrative effort and violating the requirement for least effort and future-proofing.
★ When this WOULD be the correct answer
If the requirement was to apply the policy only to specific subscriptions (e.g., a subset of subscriptions under a management group) and not to all subscriptions or future ones, then assigning the policy individually to those subscriptions would be correct.
Why candidates choose this
Candidates may think that assigning policies directly to subscriptions is the standard method, overlooking the efficiency of management group inheritance and the need for automatic coverage of new subscriptions.
✗Create a custom Azure RBAC role that restricts the region property and assign it to all users.Wrong answer — click to see why▾
Why this is wrong here
Azure RBAC roles control permissions to perform actions on resources, not enforce resource properties like allowed regions. This approach would require managing user assignments and does not automatically apply to new subscriptions or resources.
★ When this WOULD be the correct answer
A question where the requirement is to restrict which users can create resources in certain regions, such as 'Only the security team can deploy resources to the East US region.' In that case, a custom RBAC role with a deny assignment for other regions would be appropriate.
Why candidates choose this
Candidates may confuse RBAC (who can do what) with Azure Policy (what resources are allowed), thinking that restricting permissions on the region property can enforce compliance, but RBAC does not prevent resource creation with disallowed properties.
✗Apply an Azure Resource Manager read-only lock to each subscription.Wrong answer — click to see why▾
Why this is wrong here
Applying a read-only lock prevents resource modification or deletion but does not enforce region restrictions. The requirement is to control where resources can be deployed, not to protect existing resources from changes.
★ When this WOULD be the correct answer
A company needs to prevent accidental deletion or modification of critical resources across multiple subscriptions. Applying a read-only lock at the subscription level ensures that no resources in those subscriptions can be changed or removed without first removing the lock.
Why candidates choose this
Candidates may confuse governance controls, thinking that a lock can restrict deployment locations, or they may assume that a read-only lock is a simple way to enforce compliance without understanding its actual purpose.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.