Question 462 of 981
AZ-900 Describe Azure management and governance Practice Question
A large enterprise manages multiple Azure subscriptions for different business units. The central governance team wants to deploy a consistent landing zone across all subscriptions. The landing zone must include pre-defined Azure Policy definitions (e.g., allowed locations, allowed VM SKUs), standard RBAC role assignments (e.g., Owner, Contributor for specific security groups), and a predefined resource group structure (e.g., 'Networking', 'Security', 'Workloads'). The team wants a single, versioned artifact that can be assigned to any subscription to apply all these configurations together, with the ability to update the artifact and have changes propagate to existing assignments. Which Azure service should the team use?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Policy (which only enforces rules) with Azure Blueprints (which orchestrates multiple resource types including policies, roles, and resource groups), leading them to select Azure Policy as the answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Blueprints
Azure Blueprints is the correct choice because it is designed to orchestrate the deployment of a consistent environment by packaging together Azure Policy definitions, RBAC role assignments, and resource groups into a single, versioned artifact. When the blueprint is updated and published, existing assignments can be updated to the latest version, ensuring changes propagate across all subscriptions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is used to enforce rules and effects on resources (e.g., allowed SKUs, locations), but it does not deploy RBAC role assignments or resource groups. A single Azure Policy initiative only contains policy definitions, not other resource types like resource groups or role assignments.
When this WOULD be correct
A question that asks for enforcing compliance rules across subscriptions without deploying resource groups or RBAC roles, such as 'Which service should be used to ensure all resources in a subscription are deployed only in allowed regions?'
- ✓
Azure Blueprints
Why this is correct
Azure Blueprints enables the orchestrated deployment of a complete environment, including policies, RBAC assignments, resource groups, and even ARM templates. Blueprints are versioned and support automatic updates to existing assignments, making them ideal for landing zone deployments.
- ✗
Azure Management Groups
Why it's wrong here
Azure Management Groups provide a hierarchical structure for organizing subscriptions and applying policies or RBAC at scale through inheritance. However, they are not a single deployable artifact that includes resource groups and RBAC assignments within a package. They are used for governance hierarchy, not for deploying a landing zone as a cohesive set of resources.
When this WOULD be correct
A company wants to apply a common set of Azure Policy definitions and RBAC assignments to all subscriptions under a specific department, ensuring compliance without deploying resources. Management Groups would be correct to enforce these settings via inheritance.
- ✗
Azure Resource Graph
Why it's wrong here
Azure Resource Graph is a query service that allows you to explore and analyze Azure resources across subscriptions. It does not deploy, configure, or manage resources, policies, or RBAC assignments. It is purely a tool for discovery and reporting.
When this WOULD be correct
An administrator needs to quickly find all virtual machines in a specific region across multiple subscriptions and export the list for compliance reporting. Azure Resource Graph would be the correct service to run complex queries across subscriptions.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure BlueprintsCorrect answer▾
Why this is correct
Azure Blueprints enables the orchestrated deployment of a complete environment, including policies, RBAC assignments, resource groups, and even ARM templates. Blueprints are versioned and support automatic updates to existing assignments, making them ideal for landing zone deployments.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy only enforces individual rules (e.g., allowed locations) but cannot deploy resource groups or RBAC assignments as a single versioned artifact that can be updated and propagated to existing assignments.
★ When this WOULD be the correct answer
A question that asks for enforcing compliance rules across subscriptions without deploying resource groups or RBAC roles, such as 'Which service should be used to ensure all resources in a subscription are deployed only in allowed regions?'
Why candidates choose this
Candidates confuse Azure Policy with Blueprints because both involve policy definitions, but Blueprints additionally include resource groups and RBAC assignments as a deployable package.
✗Azure Management GroupsWrong answer — click to see why▾
Why this is wrong here
Azure Management Groups organize subscriptions hierarchically for policy and RBAC inheritance, but they cannot deploy a versioned artifact containing predefined resource groups, policies, and role assignments together as a single deployable unit.
★ When this WOULD be the correct answer
A company wants to apply a common set of Azure Policy definitions and RBAC assignments to all subscriptions under a specific department, ensuring compliance without deploying resources. Management Groups would be correct to enforce these settings via inheritance.
Why candidates choose this
Candidates may confuse Management Groups with Blueprints because both can apply policies and RBAC across subscriptions, but they overlook that Blueprints also deploy resource groups and are versioned artifacts.
✗Azure Resource GraphWrong answer — click to see why▾
Why this is wrong here
Azure Resource Graph is a query service for exploring resources across subscriptions, not for deploying or managing configurations like policies, RBAC, or resource groups. It cannot create or update a versioned landing zone artifact.
★ When this WOULD be the correct answer
An administrator needs to quickly find all virtual machines in a specific region across multiple subscriptions and export the list for compliance reporting. Azure Resource Graph would be the correct service to run complex queries across subscriptions.
Why candidates choose this
Candidates may confuse Resource Graph's ability to query resources across subscriptions with the ability to deploy and manage configurations across them, or they may think 'graph' implies a structured deployment tool.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.