Azure Blueprints vs Azure Policy vs Management Groups: Which Governance Tool to Use?
A multinational company has multiple Azure subscriptions for different business units. The central governance team wants to define a standardized environment that must be automatically applied to every new subscription. The standard must include a set of Azure Policy definitions (e.g., allowed regions), a specific Azure RBAC role assignment (e.g., a contributor access for a central security group), and a preconfigured resource group with a virtual network. The team wants to package all these components together so that they can be deployed consistently and updated centrally. Which Azure service should the team use?
Quick Answer
The answer is Azure Blueprints. This is the correct choice because Azure Blueprints is the only service that can package Azure Policy definitions, RBAC role assignments, and ARM templates—including preconfigured resource groups and virtual networks—into a single, versioned artifact that can be assigned and updated centrally across multiple subscriptions. On the Microsoft Azure Fundamentals AZ-900 exam, this question tests your understanding of how Azure Blueprints differs from Azure Policy and Management Groups for governance; a common trap is confusing Azure Policy’s ability to enforce rules with Blueprints’ ability to deploy resources and roles together. Remember that Azure Policy is for “what is allowed,” Management Groups organize subscriptions for policy inheritance, but Blueprints is the “deployment package” that builds the environment. A useful memory tip: think of Blueprints as a “shopping list” that includes policies, roles, and resources, while Policy is just one item on that list.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Blueprints
Azure Blueprints is the service designed to package together Azure Policy definitions, RBAC role assignments, and Azure Resource Manager templates (including resource groups and resources) into a single, versioned artifact that can be assigned to subscriptions. This enables organizations to enforce a consistent governance and compliance baseline across multiple subscriptions. Azure Policy alone cannot deploy RBAC assignments or resources. Azure Management Groups provide hierarchical organization and policy inheritance but do not deploy resources. ARM templates can deploy resources but cannot natively include policy or RBAC assignments as a cohesive package.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Blueprints
Why this is correct
Azure Blueprints is the correct service because it allows you to define a repeatable set of Azure resources, policy definitions, and RBAC assignments that are deployed together as a blueprint assignment. It supports versioning and central updates across multiple subscriptions.
- ✗
Azure Policy
Why it's wrong here
Azure Policy enforces rules and effects on resources but cannot deploy resource groups, virtual networks, or RBAC role assignments. It only applies policy definitions, not infrastructure resources.
When this WOULD be correct
An exam question asking: 'A company wants to enforce that all resources in a subscription are created only in specific Azure regions. Which service should they use?' would make Azure Policy correct, as it is designed for such compliance rules.
- ✗
Azure Management Groups
Why it's wrong here
Azure Management Groups provide a hierarchical structure for applying policies and RBAC across subscriptions, but they do not deploy resources or create resource groups. They are used for governance inheritance, not for deploying a standardized environment.
When this WOULD be correct
A company wants to apply a common set of Azure Policy definitions and RBAC assignments across all subscriptions in an organizational hierarchy, without deploying any resources. The question would ask: 'Which service allows you to manage access, policies, and compliance across multiple subscriptions at scale?'
- ✗
Azure Resource Manager templates
Why it's wrong here
ARM templates can deploy resources like resource groups and virtual networks, but they cannot natively include Azure Policy definitions or RBAC role assignments in a single packaged artifact. Combining all components would require additional orchestration outside of ARM templates.
When this WOULD be correct
A team needs to deploy a standardized infrastructure (e.g., a set of VMs, storage accounts, and networking) repeatedly across environments with consistent configuration. ARM templates are ideal for infrastructure-as-code deployments where the focus is on resource provisioning, not governance enforcement.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure BlueprintsCorrect answer▾
Why this is correct
Azure Blueprints is the correct service because it allows you to define a repeatable set of Azure resources, policy definitions, and RBAC assignments that are deployed together as a blueprint assignment. It supports versioning and central updates across multiple subscriptions.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy only enforces individual rules (e.g., allowed regions) but cannot package RBAC roles or preconfigured resource groups with virtual networks. It lacks the ability to deploy multiple resource types together as a single, versioned artifact.
★ When this WOULD be the correct answer
An exam question asking: 'A company wants to enforce that all resources in a subscription are created only in specific Azure regions. Which service should they use?' would make Azure Policy correct, as it is designed for such compliance rules.
Why candidates choose this
Candidates see 'standardized environment' and 'policies' and mistakenly think Azure Policy alone can deploy and manage the full environment, overlooking its limitation to only enforce rules, not deploy resources or assign roles.
✗Azure Management GroupsWrong answer — click to see why▾
Why this is wrong here
Azure Management Groups organize subscriptions hierarchically and apply governance at scale, but they cannot package Azure Policy definitions, RBAC role assignments, and preconfigured resources into a single deployable artifact. They lack the ability to include resource templates or enforce a standardized environment automatically upon subscription creation.
★ When this WOULD be the correct answer
A company wants to apply a common set of Azure Policy definitions and RBAC assignments across all subscriptions in an organizational hierarchy, without deploying any resources. The question would ask: 'Which service allows you to manage access, policies, and compliance across multiple subscriptions at scale?'
Why candidates choose this
Candidates may confuse Management Groups with Blueprints because both are used for governance at scale, but Management Groups only provide hierarchical organization and policy inheritance, not the ability to package and deploy resources or templates.
✗Azure Resource Manager templatesWrong answer — click to see why▾
Why this is wrong here
Azure Resource Manager (ARM) templates can deploy resources but cannot enforce ongoing compliance or package RBAC role assignments and policies as a single, versioned, updatable blueprint. They lack the governance lifecycle management that Azure Blueprints provides.
★ When this WOULD be the correct answer
A team needs to deploy a standardized infrastructure (e.g., a set of VMs, storage accounts, and networking) repeatedly across environments with consistent configuration. ARM templates are ideal for infrastructure-as-code deployments where the focus is on resource provisioning, not governance enforcement.
Why candidates choose this
Candidates know ARM templates can deploy resources and may think they can include policy definitions and role assignments as nested deployments, overlooking that Blueprints are specifically designed to orchestrate and manage those governance artifacts together.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
ARM
ARM stands for Azure Resource Manager, the management layer that enables you to create, update, and delete resources in your Azure account.
Key term
Azure resource
An Azure resource is a manageable item available through Microsoft Azure, such as a virtual machine, database, or web app.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on AZ-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company manages multiple Azure subscriptions for different business units. They want to define a standard set of policies, such as allowed VM SKUs and required resource tags, and ensure these policies are always applied whenever a new subscription is created. Which Azure feature should they use to enforce governance at this level?
medium- ✓ A.Azure Management Groups
- B.Azure Policy
- C.Azure Resource Manager templates
- D.Azure Blueprints
Why A: Azure Management Groups allow you to organize subscriptions into a hierarchy and apply governance policies at the management group level. When a new subscription is created under a management group, it automatically inherits the policies assigned to that group, ensuring consistent enforcement across all subscriptions without manual intervention.
Variation 2. A large enterprise manages multiple Azure subscriptions for different business units. The central governance team wants to deploy a consistent landing zone across all subscriptions. The landing zone must include pre-defined Azure Policy definitions (e.g., allowed locations, allowed VM SKUs), standard RBAC role assignments (e.g., Owner, Contributor for specific security groups), and a predefined resource group structure (e.g., 'Networking', 'Security', 'Workloads'). The team wants a single, versioned artifact that can be assigned to any subscription to apply all these configurations together, with the ability to update the artifact and have changes propagate to existing assignments. Which Azure service should the team use?
medium- A.Azure Policy
- ✓ B.Azure Blueprints
- C.Azure Management Groups
- D.Azure Resource Graph
Why B: Azure Blueprints is the correct choice because it is designed to orchestrate the deployment of a consistent environment by packaging together Azure Policy definitions, RBAC role assignments, and resource groups into a single, versioned artifact. When the blueprint is updated and published, existing assignments can be updated to the latest version, ensuring changes propagate across all subscriptions.
Variation 3. A large enterprise has multiple Azure subscriptions for different business units. The governance team wants to apply a set of Azure Policy initiatives, such as allowed locations and required tags, to all subscriptions in the organization. They also want to set up role-based access control for the compliance team at the root level so that they can monitor compliance across all subscriptions. Which Azure feature should they use to achieve this?
medium- A.Azure Resource Manager (ARM) templates
- ✓ B.Azure management groups
- C.Azure resource groups
- D.Azure Blueprints
Why B: Azure management groups provide a hierarchical structure above subscriptions, enabling you to apply Azure Policy initiatives and role-based access control (RBAC) at the root management group level. This ensures that policies like allowed locations and required tags are inherited by all subscriptions within the organization, and the compliance team can monitor compliance across the entire hierarchy without needing to configure each subscription individually.
Variation 4. A large enterprise manages Azure subscriptions for three business units: Sales, Research & Development, and Information Technology. Each business unit has its own Azure subscription. The central governance team needs to ensure that a specific set of Azure Policy definitions (e.g., restricting allowed regions to 'East US' only) is applied to all current and future subscriptions belonging to these three business units. The team wants to minimize administrative overhead and ensure that any new subscription created for a business unit automatically inherits the same policies. Which Azure feature should the team use to achieve this goal?
medium- A.Assign each policy definition individually to every subscription.
- ✓ B.Create a management group for each business unit, place the corresponding subscription inside each management group, and assign the policy set to each management group.
- C.Create a single resource group at the tenant root level and assign the policy definitions to that resource group.
- D.Use Azure Blueprints to deploy a new subscription with the policies, then manually move each existing subscription into the blueprint's management group.
Why B: Management groups provide a hierarchical structure above subscriptions, allowing Azure Policy assignments to be inherited by all subscriptions within a management group. By placing each business unit's subscription into its own management group and assigning the policy set (initiative) to each management group, the central governance team ensures that any current or future subscription under those management groups automatically inherits the policies, minimizing administrative overhead.
Variation 5. A large enterprise has multiple Azure subscriptions for different departments. The central IT team wants to enforce a policy that restricts the Azure regions where resources can be deployed. The policy must automatically apply to all existing subscriptions and to any new subscriptions created in the future, without requiring manual assignment to each subscription individually. Which Azure feature should the central IT team use to achieve this hierarchical governance?
medium- ✓ A.Azure Management Groups
- B.Azure Blueprints
- C.Azure Resource Groups
- D.Azure Policy alone assigned to each subscription
Why A: Azure Management Groups provide a hierarchical structure above subscriptions, allowing policies (like region restrictions) to be assigned at the management group level. This inheritance ensures the policy automatically applies to all existing subscriptions within the group and to any new subscriptions added later, without manual per-subscription assignment.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.