AZ-900 Describe Azure management and governance Practice Question
A company has 15 Azure subscriptions organized under multiple management groups. The security team has defined a standard set of 8 Azure Policy definitions that must be applied to every subscription. These definitions enforce required tags, deny creation of public IPs, require encryption for storage accounts, and restrict VM SKUs. The team wants to assign these policies as a single entity to simplify management and ensure consistent compliance. What should the team create and assign?
⚠ Common exam trap
Watch out — candidates often confuse Azure Blueprints with Policy initiatives, thinking Blueprints are the correct way to group policies, but Blueprints are for full environment deployment and versioning, not for simply grouping policy definitions for assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An Azure Policy initiative (policy set definition) containing the policy definitions
An Azure Policy initiative (policy set definition) allows grouping multiple individual policy definitions into a single set, which can then be assigned as one entity. This simplifies management and ensures consistent compliance across all subscriptions, as the security team requires. Assigning the initiative at the root management group applies it to all 15 subscriptions under the management groups.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An Azure Blueprint containing the policy definitions
Why it's wrong here
Azure Blueprints can package policy definitions along with other Azure resources (e.g., resource groups, RBAC assignments, ARM templates). However, Blueprints are being deprecated in favor of deployment stacks and templates, and they are more than what is needed here. For simply grouping policy definitions for assignment, an initiative is the appropriate service.
When this WOULD be correct
An Azure Blueprint would be correct if the question required deploying a complete environment that includes not only policy definitions but also role assignments, resource groups, and ARM templates, all versioned and tracked together for compliance and governance.
- ✓
An Azure Policy initiative (policy set definition) containing the policy definitions
Why this is correct
An Azure Policy initiative (policy set definition) is designed specifically to group multiple policy definitions into a single, assignable unit. Assigning the initiative to the appropriate management group or subscription applies all included policies at once, simplifying management and enabling consolidated compliance reporting.
- ✗
An Azure Policy assignment for each individual definition at the root management group
Why it's wrong here
Assigning each definition individually is possible but does not meet the requirement to manage them as a single entity. This approach increases administrative overhead because each assignment must be managed separately, and compliance reporting is fragmented.
When this WOULD be correct
If the question asked for assigning a single policy definition to all subscriptions under a management group, or if the requirement was to apply a specific policy (not a set) at the root level to enforce a single rule across all subscriptions.
- ✗
An Azure Resource Manager template that deploys the policy definitions
Why it's wrong here
An ARM template can deploy policy definitions and their assignments, but it does not provide a native grouping mechanism like an initiative. After deployment, each policy assignment remains separate, and you cannot manage them as a single unit in the Azure portal or SDK.
When this WOULD be correct
A company needs to deploy a consistent set of Azure resources (e.g., VMs, storage accounts) with built-in policies across multiple subscriptions, and wants to version-control the deployment. In that case, an ARM template would be correct to deploy the resources and policies together as code.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓An Azure Policy initiative (policy set definition) containing the policy definitionsCorrect answer▾
Why this is correct
An Azure Policy initiative (policy set definition) is designed specifically to group multiple policy definitions into a single, assignable unit. Assigning the initiative to the appropriate management group or subscription applies all included policies at once, simplifying management and enabling consolidated compliance reporting.
✗An Azure Blueprint containing the policy definitionsWrong answer — click to see why▾
Why this is wrong here
Azure Blueprints are used to orchestrate the deployment of resource groups, policies, role assignments, and ARM templates as a composable artifact, but they are not the native grouping mechanism for policy definitions. The question specifically asks for a single entity to assign policies, which is an Azure Policy initiative (policy set definition), not a Blueprint.
★ When this WOULD be the correct answer
An Azure Blueprint would be correct if the question required deploying a complete environment that includes not only policy definitions but also role assignments, resource groups, and ARM templates, all versioned and tracked together for compliance and governance.
Why candidates choose this
Candidates may confuse Blueprints with policy initiatives because both can group multiple policies, but Blueprints are broader and include additional artifacts, making them seem like a natural choice for 'simplify management and ensure consistent compliance'.
✗An Azure Policy assignment for each individual definition at the root management groupWrong answer — click to see why▾
Why this is wrong here
Assigning each policy definition individually at the root management group would require managing 8 separate assignments, which contradicts the requirement to assign them as a single entity for simplified management and consistent compliance.
★ When this WOULD be the correct answer
If the question asked for assigning a single policy definition to all subscriptions under a management group, or if the requirement was to apply a specific policy (not a set) at the root level to enforce a single rule across all subscriptions.
Why candidates choose this
Candidates may think that assigning at the root management group ensures inheritance to all subscriptions, and they might overlook the need for a single entity (initiative) to group multiple definitions together for easier management.
✗An Azure Resource Manager template that deploys the policy definitionsWrong answer — click to see why▾
Why this is wrong here
An Azure Resource Manager template can deploy policy definitions, but it does not create a single assignable entity that groups multiple policy definitions together for simplified management and consistent compliance. The question requires a single entity to assign, which is an initiative, not a template.
★ When this WOULD be the correct answer
A company needs to deploy a consistent set of Azure resources (e.g., VMs, storage accounts) with built-in policies across multiple subscriptions, and wants to version-control the deployment. In that case, an ARM template would be correct to deploy the resources and policies together as code.
Why candidates choose this
Candidates may think ARM templates are the standard way to deploy and manage Azure resources, including policies, and overlook that initiatives are specifically designed for grouping policy definitions as a single assignable unit.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
Key term
Initiative
An initiative is a formal, structured effort or project undertaken by an organization to achieve a specific strategic goal, often involving changes to IT systems, policies, or processes.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.