AZ-900 Blueprint Versioning Practice Question
A company uses Azure Blueprints to define a standard environment with policies, role assignments, and resource groups. They publish a new version of the blueprint that adds a new role assignment. However, existing subscriptions created from older versions do not have this new role assignment. What must they do to apply the update to existing subscriptions?
⚠ Common exam trap
The trap here is assuming that publishing a new blueprint version automatically propagates changes to existing assignments, when in fact you must manually update the assignment to the new version to apply the changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
They need to update the existing blueprint assignment to use the latest published version.
Azure Blueprints assignments are not automatically updated when a new version of the blueprint is published. To apply the new role assignment to existing subscriptions, you must update the existing blueprint assignment to reference the latest published version. This triggers Azure to evaluate and apply the changes defined in the new version, including the new role assignment, to the assigned subscriptions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete and recreate the subscriptions using the new blueprint.
Why it's wrong here
Deleting and recreating the subscriptions is destructive and unnecessary because this would remove all workloads, configuration, and the subscription's identity, not just the blueprint artifacts. The existing assignment can be updated in place to the latest version, so recreating the scope adds downtime and operational risk while providing no governance benefit. This approach is particularly inappropriate for production environments where resource continuity is required.
When this WOULD be correct
This would be correct if the question stated that the blueprint cannot be updated on existing subscriptions due to policy constraints, and the only way to enforce the new configuration is to provision new subscriptions from scratch.
- ✗
The blueprint version update is automatically applied to all existing subscriptions.
Why it's wrong here
Azure Blueprints does not automatically push new published versions to existing assignments; the assignment remains pinned to the version you selected until you explicitly update it. This behavior is by design, because automatic updates could introduce unexpected policy changes or RBAC changes into stable environments. The user must review and approve the update, then update the assignment to benefit from the latest artifacts.
When this WOULD be correct
If the question stated that the blueprint was configured with 'auto-update' enabled (which is not a real feature) or if the update was a minor change that Azure automatically propagates (not the case for role assignments), then option B could be considered correct.
- ✗
They must manually assign the role to each subscription.
Why it's wrong here
Manually assigning a role to each subscription would be error-prone and would not register those role assignments as blueprint artifacts, leaving them outside the blueprint's versioned, auditable lifecycle. Because role definitions and assignments are first-class artifacts in the blueprint, updating the assignment automatically creates, updates, or removes role assignments through the blueprint's managed identity. Doing this by hand also makes it harder to reproduce the same standard environment across multiple subscriptions.
When this WOULD be correct
This option would be correct if the question stated that the blueprint was not used to manage the subscriptions (e.g., resources were deployed manually or via ARM templates) and there is no existing blueprint assignment to update. In that case, manual role assignment would be necessary.
- ✓
They need to update the existing blueprint assignment to use the latest published version.
Why this is correct
Updating the assignment is the supported way to apply a newer published blueprint version to the management groups and subscriptions already in scope. The assignment stores a reference to the exact version; changing that reference to the latest published version triggers a reconciliation that deploys newly added artifacts and updates existing ones without deleting the target resources.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓They need to update the existing blueprint assignment to use the latest published version.Correct answer▾
Why this is correct
Updating the assignment is the supported way to apply a newer published blueprint version to the management groups and subscriptions already in scope. The assignment stores a reference to the exact version; changing that reference to the latest published version triggers a reconciliation that deploys newly added artifacts and updates existing ones without deleting the target resources.
✗Delete and recreate the subscriptions using the new blueprint.Wrong answer — click to see why▾
Why this is wrong here
Deleting and recreating subscriptions is unnecessary and disruptive; Azure Blueprints support updating existing assignments by assigning a newer version of the blueprint to the same scope, which applies changes like new role assignments without destroying resources.
★ When this WOULD be the correct answer
This would be correct if the question stated that the blueprint cannot be updated on existing subscriptions due to policy constraints, and the only way to enforce the new configuration is to provision new subscriptions from scratch.
Why candidates choose this
Candidates may think that blueprint updates require a fresh deployment because they confuse blueprints with immutable templates, or they underestimate Azure's capability to update existing assignments in-place.
✗The blueprint version update is automatically applied to all existing subscriptions.Wrong answer — click to see why▾
Why this is wrong here
Azure Blueprints do not automatically apply new versions to existing assignments; updates must be explicitly assigned to subscriptions.
★ When this WOULD be the correct answer
If the question stated that the blueprint was configured with 'auto-update' enabled (which is not a real feature) or if the update was a minor change that Azure automatically propagates (not the case for role assignments), then option B could be considered correct.
Why candidates choose this
Candidates may assume that blueprint version updates are automatically applied to existing subscriptions, similar to how some Azure policies or updates are automatically enforced.
✗They must manually assign the role to each subscription.Wrong answer — click to see why▾
Why this is wrong here
Azure Blueprints support versioning and assignment updates; you do not need to manually assign roles to each subscription. Instead, you update the existing blueprint assignment to the latest version, which applies the new role assignment automatically.
★ When this WOULD be the correct answer
This option would be correct if the question stated that the blueprint was not used to manage the subscriptions (e.g., resources were deployed manually or via ARM templates) and there is no existing blueprint assignment to update. In that case, manual role assignment would be necessary.
Why candidates choose this
Candidates may think that blueprint updates are not retroactive and assume manual intervention is required, overlooking the ability to update the blueprint assignment to propagate changes.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Blueprint
A blueprint in IT certification is a document that outlines the topics, skills, and weighting for an exam, telling you exactly what to study.
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.