AZ-900 Describe Azure management and governance Practice Question
A company has a regulatory requirement that all Azure resources must be deployed only in the West Europe region. The governance team needs to automatically prevent any user or application from creating resources in any other region. The team must also ensure that this restriction is applied to all existing and future subscriptions within the tenant. Which Azure service should the governance team use?
⚠ Common exam trap
It's easy for candidates to confuse the container/scope (Management Groups) with the enforcement mechanism (Azure Policy), leading candidates to select Management Groups because they organize subscriptions, even though they cannot enforce rules on their own.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy
Azure Policy is correct because it enforces organizational standards by evaluating resources for compliance with defined rules, such as restricting allowed regions. By creating a policy definition that denies resource creation outside West Europe and assigning it at the management group scope, the restriction applies to all existing and future subscriptions within the tenant automatically.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Policy
Why this is correct
Correct. Azure Policy allows you to create, assign, and manage policies that enforce different rules over your resources. The 'Allowed Locations' policy definition can be assigned at a management group scope to block creation of resources in regions other than West Europe, and this applies to all subscriptions under that scope.
- ✗
Azure Blueprints
Why it's wrong here
Incorrect. Azure Blueprints is used to define a repeatable set of Azure resources and policies that implement and adhere to standards and patterns. While a blueprint can include policy assignments, the enforcement of the region restriction is the job of the policy itself, not the blueprint. The question asks for the service that provides the enforcement, which is Azure Policy.
When this WOULD be correct
A company needs to deploy a standardized set of Azure resources (e.g., a three-tier app with specific networking and governance policies) across multiple subscriptions, ensuring consistency and compliance. The team wants to package resource templates, policies, and role assignments into a single, repeatable artifact that can be versioned and updated.
- ✗
Management Groups
Why it's wrong here
Incorrect. Management Groups are containers that help you manage access, policy, and compliance across multiple subscriptions. They organize subscriptions into a hierarchy but do not directly enforce restrictions on which regions resources can be deployed in.
When this WOULD be correct
A company needs to apply consistent governance (e.g., cost limits, compliance tags) across multiple subscriptions by grouping them into a single management hierarchy, and then assign policies or RBAC at that level.
- ✗
Azure Role-Based Access Control (RBAC)
Why it's wrong here
Incorrect. RBAC provides fine-grained access management for Azure resources, allowing you to grant specific permissions to users, groups, and applications. While you could potentially restrict 'Create' permissions for certain regions by creating custom roles, this is not straightforward and does not automatically enforce location constraints across all resource types. Azure Policy is the designed service for such resource property enforcement.
When this WOULD be correct
A company needs to ensure that only a specific team can create virtual machines in the production subscription, while other teams can only read resources. Azure RBAC would be used to assign the 'Virtual Machine Contributor' role to the specific team and 'Reader' role to others.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure PolicyCorrect answer▾
Why this is correct
Correct. Azure Policy allows you to create, assign, and manage policies that enforce different rules over your resources. The 'Allowed Locations' policy definition can be assigned at a management group scope to block creation of resources in regions other than West Europe, and this applies to all subscriptions under that scope.
✗Azure BlueprintsWrong answer — click to see why▾
Why this is wrong here
Azure Blueprints is used for orchestrating the deployment of resource templates and policy assignments, but it does not enforce restrictions across all subscriptions automatically; it requires explicit assignment and does not prevent resource creation outside its scope.
★ When this WOULD be the correct answer
A company needs to deploy a standardized set of Azure resources (e.g., a three-tier app with specific networking and governance policies) across multiple subscriptions, ensuring consistency and compliance. The team wants to package resource templates, policies, and role assignments into a single, repeatable artifact that can be versioned and updated.
Why candidates choose this
Candidates may confuse Blueprints as a governance tool because it can include policy definitions, but they overlook that Blueprints is for orchestration and deployment, not for continuous enforcement like Azure Policy.
✗Management GroupsWrong answer — click to see why▾
Why this is wrong here
Management Groups organize subscriptions hierarchically but do not enforce resource-level restrictions like allowed regions; they are a management scope, not a policy enforcement mechanism.
★ When this WOULD be the correct answer
A company needs to apply consistent governance (e.g., cost limits, compliance tags) across multiple subscriptions by grouping them into a single management hierarchy, and then assign policies or RBAC at that level.
Why candidates choose this
Candidates may think Management Groups can enforce restrictions because they are used to organize subscriptions and apply governance, but they only provide a scope for policies, not the enforcement itself.
✗Azure Role-Based Access Control (RBAC)Wrong answer — click to see why▾
Why this is wrong here
Azure RBAC manages permissions for who can perform actions on resources, but it does not enforce resource location restrictions. RBAC cannot prevent resource creation in disallowed regions; it only controls access at the scope of management operations.
★ When this WOULD be the correct answer
A company needs to ensure that only a specific team can create virtual machines in the production subscription, while other teams can only read resources. Azure RBAC would be used to assign the 'Virtual Machine Contributor' role to the specific team and 'Reader' role to others.
Why candidates choose this
Candidates may confuse RBAC's ability to restrict actions with the ability to restrict resource properties like region, assuming that denying 'write' permission at a high scope would block all resource creation, but RBAC does not filter by region.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.