Understanding Azure Policy Inheritance in Management Group Hierarchies
A company has a management group hierarchy: Root > Europe > Production. They assign a policy at the Root level that denies creation of resources without a tag. Later, they assign a different policy at the Europe level. What is the effective effect on the Production subscription?
Quick Answer
The correct answer is that both policies apply. This is because Azure Policy inheritance in management group hierarchies works by default: any policy assigned at a higher-level management group, such as Root, flows down to all child management groups, including Europe, and their subscriptions, like Production. When a second policy is assigned at the Europe level, it does not replace or override the Root-level policy; instead, both are evaluated and enforced, with the most restrictive effect taking precedence. On the AZ-900 exam, this concept tests your understanding of how policy inheritance cascades through management groups, and a common trap is assuming that a lower-level assignment cancels a higher-level one. Remember the memory tip: “Inheritance adds, it never subtracts”—policies stack downward, so the Production subscription is subject to both the tag-denial policy from Root and the additional policy from Europe.
⚠ Common exam trap
Candidates often confuse Azure Policy inheritance with role-based access control (RBAC) inheritance, where a lower-level assignment can override a higher-level one, but Azure Policy is cumulative and does not support override behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Both policies apply
Azure Policy is inherited by default from higher-level management groups down to subscriptions. When a policy is assigned at the Root management group, it applies to all child management groups and subscriptions, including the Production subscription. Assigning an additional policy at the Europe management group does not remove or override the Root-level policy; instead, both policies are evaluated and enforced, with the most restrictive effect taking precedence. Therefore, the Production subscription is subject to both policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Only the policy at the Europe level applies
Why it's wrong here
Policies are inherited, so both policies apply.
When this WOULD be correct
If the question stated that the policy at the Europe level was set to 'Deny' and the Root policy was set to 'Audit', and there is a rule that a Deny overrides an Audit, then only the Europe-level policy would apply. Alternatively, if the question specified that the Root policy was disabled or not inherited, then only the Europe-level policy would apply.
- ✗
Only the policy at the Root level applies
Why it's wrong here
Policies are not replaced; they accumulate.
When this WOULD be correct
If the question stated that the policy at the Europe level was set to 'Deny' with a higher priority (e.g., through explicit exclusion or a policy with 'Deny' effect that overrides), or if the question described a scenario where policies are applied at the same scope but the lower-level policy is set to 'Audit' and the higher-level policy is 'Deny', then only the higher-level policy might apply. However, in standard inheritance without exclusion, both apply.
- ✓
Both policies apply
Why this is correct
Policies assigned at different levels in the management group hierarchy all apply to child subscriptions.
- ✗
The policy at the lower level overrides the Root policy
Why it's wrong here
There is no override; all policies are evaluated.
When this WOULD be correct
This option would be correct if the question stated that the policy at the Europe level was assigned with a 'Deny' effect and the Root policy was assigned with an 'Audit' effect, and the question asked about the effective effect for a specific resource type where the Europe policy explicitly overrides the Root policy due to policy conflict resolution rules (e.g., deny overrides audit).
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Both policies applyCorrect answer▾
Why this is correct
Policies assigned at different levels in the management group hierarchy all apply to child subscriptions.
✗Only the policy at the Europe level appliesWrong answer — click to see why▾
Why this is wrong here
Azure policies are inherited by default from parent management groups to child subscriptions. The policy at the Root level applies to all children, including the Production subscription, and the Europe-level policy adds additional restrictions. Both policies are enforced, not just one.
★ When this WOULD be the correct answer
If the question stated that the policy at the Europe level was set to 'Deny' and the Root policy was set to 'Audit', and there is a rule that a Deny overrides an Audit, then only the Europe-level policy would apply. Alternatively, if the question specified that the Root policy was disabled or not inherited, then only the Europe-level policy would apply.
Why candidates choose this
Candidates may think that policies are applied like firewall rules where the most specific or closest rule takes precedence, or they may confuse policy inheritance with group policy in Active Directory where a child can override a parent.
✗Only the policy at the Root level appliesWrong answer — click to see why▾
Why this is wrong here
Azure policy inheritance is cumulative; policies assigned at higher levels (Root) are inherited by lower levels (Europe, Production). Both policies apply, so the Production subscription is subject to both the Root-level and Europe-level policies.
★ When this WOULD be the correct answer
If the question stated that the policy at the Europe level was set to 'Deny' with a higher priority (e.g., through explicit exclusion or a policy with 'Deny' effect that overrides), or if the question described a scenario where policies are applied at the same scope but the lower-level policy is set to 'Audit' and the higher-level policy is 'Deny', then only the higher-level policy might apply. However, in standard inheritance without exclusion, both apply.
Why candidates choose this
Candidates may mistakenly think that policies work like firewall rules or group policies where a more specific (lower-level) setting overrides a general one, not realizing that Azure policies are additive and inherited unless explicitly excluded.
✗The policy at the lower level overrides the Root policyWrong answer — click to see why▾
Why this is wrong here
In Azure, policies are inherited by default and cumulative; a lower-level policy does not override a higher-level policy. Both policies apply, so option D is incorrect.
★ When this WOULD be the correct answer
This option would be correct if the question stated that the policy at the Europe level was assigned with a 'Deny' effect and the Root policy was assigned with an 'Audit' effect, and the question asked about the effective effect for a specific resource type where the Europe policy explicitly overrides the Root policy due to policy conflict resolution rules (e.g., deny overrides audit).
Why candidates choose this
Candidates may think of policy inheritance like GPOs in Active Directory, where a lower-level policy can override a higher-level one, or they may confuse Azure Policy with RBAC where assignments can be additive and explicit denies override allows.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Tag
A tag is a metadata label attached to a cloud resource or IT asset to organize, track, and manage it based on custom attributes like environment, owner, or cost center.
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a management group hierarchy: Root (tenant root group) > Contoso > Sales, Marketing. They want to assign an Azure policy that applies to all subscriptions under the Sales and Marketing management groups only. The policy must not affect any other subscriptions in the hierarchy. Where should they assign the policy?
hard- ✓ A.Assign the policy separately at both the Sales and Marketing management groups.
- B.At the Root management group.
- C.At the Contoso management group.
- D.At the Sales management group only.
Why A: Azure Policy assignments are inherited by all child resources within the scope where the policy is assigned. To restrict the policy to only the Sales and Marketing management groups without affecting other subscriptions under Contoso, you must assign the policy separately to each of those two management groups. Assigning at a higher scope (e.g., Contoso or Root) would cause the policy to apply to all subscriptions under that scope, including any other child management groups or subscriptions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.