Describe Azure management and governance →mediumMultiple ChoiceObjective-mapped

AZ-900 Describe Azure management and governance Practice Question

A multinational company has 10 Azure subscriptions, each managed by a different department. The central governance team wants to deploy a standardized environment that includes a specific network topology (virtual network, subnets, and network security groups), a set of Azure Policy definitions to enforce tagging and encryption, and a role assignment granting the 'Reader' role to a central security team in every subscription. The team must be able to update this standard definition in one place, and any changes should automatically apply to all existing deployments that were created from the definition. Which Azure service should they use?

⚠ Common exam trap

Test-takers frequently confuse Azure Blueprints with ARM templates or Azure Policy, not realizing that Blueprints uniquely combine infrastructure deployment, policy enforcement, and role assignments in a versioned, upgradeable package that automatically propagates updates to existing deployments.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Azure Blueprints

Azure Blueprints is the correct choice because it enables the central governance team to define a repeatable, versioned environment that includes network topology, Azure Policy definitions, and role assignments. Blueprints support versioning and automatic updates: when a blueprint is updated and published, existing blueprint assignments can be upgraded to apply the new definitions to all deployed resources, ensuring consistency across all 10 subscriptions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Azure Policy
Why it's wrong here
Azure Policy enforces compliance rules (like tagging and encryption), but it does not deploy resources such as virtual networks or role assignments. It also does not provide a mechanism to deploy and update a complete set of resources across subscriptions in a coordinated, versioned way.
When this WOULD be correct
A question where the requirement is solely to enforce tagging and encryption rules across subscriptions, without deploying infrastructure or managing role assignments, and updates should apply to existing resources via policy compliance evaluation.
✓
Azure Blueprints
Why this is correct
Azure Blueprints allows you to define a repeatable set of Azure resources, policies, role assignments, and more. Blueprints can be deployed to multiple subscriptions, and when the blueprint definition is updated, existing assignments can be upgraded to apply the changes automatically. This meets all the requirements: consistent deployment, central updates, and automatic propagation.
✗
Azure Resource Manager (ARM) templates
Why it's wrong here
ARM templates can deploy resources, policies, and role assignments, but they are static deployments. If the governance team updates the template, they would need to redeploy it to each subscription manually; there is no built-in 'update and automatically apply' feature like Blueprints provides for existing deployments.
When this WOULD be correct
An organization needs to deploy a consistent set of resources (e.g., VMs, storage accounts) across multiple environments (dev, test, prod) using infrastructure as code, and they want to version-control the templates and redeploy when changes are needed.
✗
Azure Management Groups
Why it's wrong here
Management Groups organize subscriptions hierarchically and can be used to assign policies and RBAC roles at a scope. However, they do not deploy Azure resources like virtual networks or subnets. They are a governance structure, not a deployment service.
When this WOULD be correct
A company wants to apply the same set of Azure Policy definitions and role assignments across multiple subscriptions, and they need to organize subscriptions hierarchically for governance. Management Groups would be correct because they allow policy and RBAC inheritance without deploying resources.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

✓Azure BlueprintsCorrect answer▾

Why this is correct

Azure Blueprints allows you to define a repeatable set of Azure resources, policies, role assignments, and more. Blueprints can be deployed to multiple subscriptions, and when the blueprint definition is updated, existing assignments can be upgraded to apply the changes automatically. This meets all the requirements: consistent deployment, central updates, and automatic propagation.

✗Azure PolicyWrong answer — click to see why▾

Why this is wrong here

Azure Policy enforces compliance rules (e.g., tagging, encryption) but cannot deploy and manage the full standardized environment including network topology and role assignments as a single, versioned, updatable artifact that applies to existing deployments.

★ When this WOULD be the correct answer

A question where the requirement is solely to enforce tagging and encryption rules across subscriptions, without deploying infrastructure or managing role assignments, and updates should apply to existing resources via policy compliance evaluation.

Why candidates choose this

Candidates see 'Azure Policy definitions to enforce tagging and encryption' in the question and assume Azure Policy is the answer, overlooking the need for a holistic deployment and lifecycle management solution like Blueprints.

✗Azure Resource Manager (ARM) templatesWrong answer — click to see why▾

Why this is wrong here

ARM templates deploy infrastructure but do not provide a built-in mechanism to automatically apply updates to existing deployments when the template changes; they are typically used for initial deployment or redeployment, not for ongoing governance updates.

★ When this WOULD be the correct answer

An organization needs to deploy a consistent set of resources (e.g., VMs, storage accounts) across multiple environments (dev, test, prod) using infrastructure as code, and they want to version-control the templates and redeploy when changes are needed.

Why candidates choose this

Candidates may confuse ARM templates with Azure Blueprints because both can define resources and policies, but they overlook that Blueprints specifically support versioned updates that automatically apply to existing assignments.

✗Azure Management GroupsWrong answer — click to see why▾

Why this is wrong here

Azure Management Groups manage access, policy, and compliance across subscriptions but cannot deploy and version infrastructure components like network topology or role assignments. They lack the ability to create and update a standardized environment definition that automatically applies changes to existing deployments.

★ When this WOULD be the correct answer

A company wants to apply the same set of Azure Policy definitions and role assignments across multiple subscriptions, and they need to organize subscriptions hierarchically for governance. Management Groups would be correct because they allow policy and RBAC inheritance without deploying resources.

Why candidates choose this

Candidates may think Management Groups can deploy standardized environments because they aggregate subscriptions and apply policies, but they confuse governance hierarchy with deployment automation.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Visual reference

Go deeper

AZ-900 Describe Azure management and governance Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question