AZ-900 Describe Azure management and governance Practice Question
A healthcare organization needs to enforce a set of compliance requirements (e.g., enable encryption on all storage accounts, restrict public network access to SQL databases, and enforce a specific TLS version) across all Azure subscriptions. The organization has defined these requirements as individual Azure Policy definitions. The governance team wants to assign all these policies together as a single unit to a management group, ensuring that any new subscription created under that group automatically receives all the policies. Which Azure object should the governance team create first?
⚠ Common exam trap
Test-takers frequently confuse Azure Blueprints (which also group policies and templates) with Policy Initiatives, but Blueprints are deprecated and not the correct answer for grouping policies alone; the exam tests whether you know that an initiative is the native grouping construct for policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy initiative
An Azure Policy initiative is a collection of individual policy definitions designed to group related policies together for assignment as a single unit. By creating an initiative that contains the required compliance policies (encryption, network restrictions, TLS version) and assigning it to a management group, any new subscription under that group automatically inherits the initiative, ensuring consistent enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Policy initiative
Why this is correct
Correct. An Azure Policy initiative (policy set definition) groups related individual policy definitions into a single unit that can be assigned at scale. This allows the organization to enforce all compliance requirements together consistently across subscriptions.
- ✗
Azure Blueprint
Why it's wrong here
Incorrect. An Azure Blueprint is used to orchestrate the deployment of a complete environment, including policies, role assignments, and resource templates. While it can include policies, the scenario already has individual policies defined; creating a blueprint would add unnecessary complexity and is not the primary object needed to simply group existing policies for assignment.
When this WOULD be correct
An Azure Blueprint would be correct if the question required deploying a complete environment including resource groups, role assignments, policy definitions, and ARM templates together as a single package. For example: 'An organization needs to deploy a standardized environment that includes a resource group, a virtual network, a set of policies, and role assignments, all versioned and tracked together.'
- ✗
Azure Management Group
Why it's wrong here
Incorrect. A management group is a container that helps manage access, policies, and compliance across multiple subscriptions. It serves as a scope where policies or initiatives can be assigned, but it is not the object that groups policies together. The governance team must first create the initiative to group the policies, then assign the initiative to the management group.
When this WOULD be correct
An exam question might ask: 'You need to organize multiple Azure subscriptions under a single hierarchy to apply consistent role-based access control and policy inheritance. Which Azure object should you create first?' In that case, creating a management group is the correct first step.
- ✗
Azure Resource Manager template
Why it's wrong here
Incorrect. An Azure Resource Manager (ARM) template is a JSON file used for deploying Azure resources declaratively. It does not group policy definitions for assignment; it is used for infrastructure as code. For grouping policies, an Azure Policy initiative is the appropriate object.
When this WOULD be correct
An ARM template would be correct if the question asked for a repeatable deployment of a specific set of Azure resources (e.g., VMs, storage, networking) with consistent configuration, such as deploying a multi-tier application environment across multiple subscriptions.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Policy initiativeCorrect answer▾
Why this is correct
Correct. An Azure Policy initiative (policy set definition) groups related individual policy definitions into a single unit that can be assigned at scale. This allows the organization to enforce all compliance requirements together consistently across subscriptions.
✗Azure BlueprintWrong answer — click to see why▾
Why this is wrong here
Azure Blueprint is a deprecated service that was used to orchestrate the deployment of policy definitions, role assignments, and resource groups, but it is not the correct object to group multiple policy definitions into a single assignable unit. The question specifically asks for grouping individual Azure Policy definitions into a single unit, which is an initiative, not a blueprint.
★ When this WOULD be the correct answer
An Azure Blueprint would be correct if the question required deploying a complete environment including resource groups, role assignments, policy definitions, and ARM templates together as a single package. For example: 'An organization needs to deploy a standardized environment that includes a resource group, a virtual network, a set of policies, and role assignments, all versioned and tracked together.'
Why candidates choose this
Candidates may confuse Blueprints with initiatives because both can group policies, but Blueprints are broader and include other artifacts. The term 'blueprint' sounds like a plan for compliance, making it tempting for those who don't know it's deprecated or its exact scope.
✗Azure Management GroupWrong answer — click to see why▾
Why this is wrong here
A management group is a container for organizing subscriptions and applying governance at scale, but it does not bundle multiple policy definitions into a single assignable unit. The question asks for an object that groups policies together, which is an initiative, not a management group.
★ When this WOULD be the correct answer
An exam question might ask: 'You need to organize multiple Azure subscriptions under a single hierarchy to apply consistent role-based access control and policy inheritance. Which Azure object should you create first?' In that case, creating a management group is the correct first step.
Why candidates choose this
Candidates may confuse the role of management groups as a governance container with the ability to group policies, because policies are often assigned at the management group level, leading them to think the management group itself is the grouping object.
✗Azure Resource Manager templateWrong answer — click to see why▾
Why this is wrong here
An Azure Resource Manager (ARM) template is used for deploying infrastructure as code, not for grouping and assigning multiple policy definitions as a single unit. The question requires a grouping of policies, which is the purpose of an initiative, not a template.
★ When this WOULD be the correct answer
An ARM template would be correct if the question asked for a repeatable deployment of a specific set of Azure resources (e.g., VMs, storage, networking) with consistent configuration, such as deploying a multi-tier application environment across multiple subscriptions.
Why candidates choose this
Candidates may confuse ARM templates with policy initiatives because both can be used to enforce or deploy consistent configurations, but templates focus on resource deployment, not policy assignment.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.