AZ-900 Describe Azure management and governance Practice Question
A company has a management group hierarchy: Root (tenant root group) > Contoso > Sales, Marketing. They want to assign an Azure policy that applies to all subscriptions under the Sales and Marketing management groups only. The policy must not affect any other subscriptions in the hierarchy. Where should they assign the policy?
⚠ Common exam trap
Test-takers frequently assume assigning at the parent management group (Contoso) is sufficient, not realizing that inheritance would apply the policy to all child management groups, including any unintended ones, rather than only the specified Sales and Marketing groups.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the policy separately at both the Sales and Marketing management groups.
Azure Policy assignments are inherited by all child resources within the scope where the policy is assigned. To restrict the policy to only the Sales and Marketing management groups without affecting other subscriptions under Contoso, you must assign the policy separately to each of those two management groups. Assigning at a higher scope (e.g., Contoso or Root) would cause the policy to apply to all subscriptions under that scope, including any other child management groups or subscriptions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign the policy separately at both the Sales and Marketing management groups.
Why this is correct
Azure Policy assignments are scoped to a single management group, subscription, or resource group, and the policy is inherited by all child resources. To cover exactly the Sales and Marketing management groups without including their sibling groups or the broader Contoso branch, you must create a separate assignment at each of those two management group scopes. Each assignment independently enforces the same definition, so both groups receive the policy while other management groups (e.g., any other children under Contoso) remain unaffected. This is the only way to meet the requirement of limiting the policy to precisely these two groups in this hierarchy.
- ✗
At the Root management group.
Why it's wrong here
The Root management group is the top-level scope in an Azure tenant hierarchy; any policy assigned there is inherited by every management group, subscription, and resource group within the entire tenant. Assigning at Root would therefore apply the policy to Contoso, Sales, Marketing, and any other management groups or subscriptions that exist, not just the two target groups. This is far broader than the requirement, which explicitly wants the policy limited to only Sales and Marketing. Even if you later attempted to use exclusions, this scope would create a huge administrative burden and risk unintended enforcement, so it is not the correct approach.
When this WOULD be correct
If the requirement was to apply the policy to all subscriptions in the entire tenant (all management groups and subscriptions), then assigning at the Root management group would be correct.
- ✗
At the Contoso management group.
Why it's wrong here
The Contoso management group is the parent of both Sales and Marketing, but it may also contain other child management groups, subscriptions, or resource groups. Since Azure Policy assignments are inherited by all descendant scopes, assigning at Contoso would enforce the policy on every group under it, not just Sales and Marketing. Any additional children under Contoso would receive the policy even if they are not supposed to, violating the requirement to limit the policy strictly to Sales and Marketing. To avoid this, you cannot use the parent scope; you must assign separately at each intended child group.
When this WOULD be correct
If the requirement were to apply the policy to all subscriptions under the Contoso management group (including Sales, Marketing, and any other child groups), then assigning at Contoso would be correct.
- ✗
At the Sales management group only.
Why it's wrong here
Assigning the policy only at the Sales management group would enforce it on Sales and all of its descendant subscriptions and resource groups, but it would not affect Marketing. Because policy inheritance flows downward in the management group hierarchy, a policy assigned at Sales cannot cross over to its sibling Marketing management group. This leaves Marketing without the required policy, so the assignment fails to satisfy the stated condition that both Sales and Marketing must be covered. Therefore, a single assignment at Sales alone is insufficient.
When this WOULD be correct
If the question stated that the policy should apply only to subscriptions under the Sales management group and not to Marketing, then assigning at the Sales management group alone would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign the policy separately at both the Sales and Marketing management groups.Correct answer▾
Why this is correct
Azure Policy assignments are scoped to a single management group, subscription, or resource group, and the policy is inherited by all child resources. To cover exactly the Sales and Marketing management groups without including their sibling groups or the broader Contoso branch, you must create a separate assignment at each of those two management group scopes. Each assignment independently enforces the same definition, so both groups receive the policy while other management groups (e.g., any other children under Contoso) remain unaffected. This is the only way to meet the requirement of limiting the policy to precisely these two groups in this hierarchy.
✗At the Root management group.Wrong answer — click to see why▾
Why this is wrong here
Assigning at the Root management group would apply the policy to all subscriptions under Root, including those under Contoso and any other management groups, not just Sales and Marketing.
★ When this WOULD be the correct answer
If the requirement was to apply the policy to all subscriptions in the entire tenant (all management groups and subscriptions), then assigning at the Root management group would be correct.
Why candidates choose this
Candidates may think Root is the top-level group that covers everything, but they overlook that it affects more than the desired scope.
✗At the Contoso management group.Wrong answer — click to see why▾
Why this is wrong here
Assigning the policy at the Contoso management group would apply it to all subscriptions under Contoso, including Sales and Marketing, but also any other child groups or subscriptions, which violates the requirement to affect only Sales and Marketing.
★ When this WOULD be the correct answer
If the requirement were to apply the policy to all subscriptions under the Contoso management group (including Sales, Marketing, and any other child groups), then assigning at Contoso would be correct.
Why candidates choose this
Candidates may think that assigning at a higher level (Contoso) will automatically cover only the desired child groups, overlooking that it also applies to other children or subscriptions under Contoso.
✗At the Sales management group only.Wrong answer — click to see why▾
Why this is wrong here
Assigning the policy only at the Sales management group would exclude the Marketing management group's subscriptions, failing to meet the requirement that the policy applies to both Sales and Marketing subscriptions.
★ When this WOULD be the correct answer
If the question stated that the policy should apply only to subscriptions under the Sales management group and not to Marketing, then assigning at the Sales management group alone would be correct.
Why candidates choose this
Candidates may mistakenly think that assigning at a higher level (Sales) will automatically propagate to all child groups, but they overlook that Marketing is a separate sibling group under Contoso.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Tenant
A dedicated and isolated instance of Microsoft Entra ID that an organization receives when signing up for a Microsoft cloud service.
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.