AZ-900 Describe Azure management and governance Practice Question
A company is adopting Azure and needs to deploy a standardized environment that includes a resource group, a virtual network with specific IP address ranges, and a set of Azure Policy definitions to restrict allowed deployment locations. The environment will be deployed to multiple subscriptions used by different departments. The company requires a repeatable, versioned package that defines the resources, policies, and role assignments as a single item. The solution must allow updates to be managed and enforced over time. Which Azure feature should the company use?
⚠ Common exam trap
It's easy for candidates to confuse ARM templates with Blueprints because both deploy resources, but Blueprints uniquely provides versioning, policy and role assignment as built-in artifacts, and the ability to manage and enforce updates across multiple subscriptions as a single package.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Blueprints
Azure Blueprints is the correct choice because it enables the orchestrated deployment of a standardized environment—including resource groups, virtual networks, Azure Policy definitions, and role assignments—as a single, versioned, and updatable package. Unlike ARM templates, Blueprints natively supports versioning, policy assignment, and role assignment as first-class artifacts, and it allows the blueprint to be assigned to multiple subscriptions while maintaining a central source of truth for updates and enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is used to enforce rules on resources, such as restricting allowed locations, but it cannot deploy resources like virtual networks or resource groups. It does not provide a repeatable deployment package for infrastructure.
When this WOULD be correct
A company needs to enforce compliance rules (e.g., restrict allowed VM SKUs or require tags) across existing and future resources without deploying any infrastructure. Azure Policy would be the correct answer for a governance-only requirement.
- ✓
Azure Blueprints
Why this is correct
Azure Blueprints allows you to define a repeatable set of Azure resources (including resource groups, virtual networks), policies, and role assignments as a single, versioned artifact. This package can be deployed consistently to multiple subscriptions and updated over time.
- ✗
ARM templates
Why it's wrong here
ARM templates are JSON-based declarative templates that define and deploy Azure infrastructure resources, including resource groups, virtual networks, and compute, using idempotent resource manager operations. Yet they are narrowly scoped to infrastructure provisioning; they do not natively include Azure Policy definitions, custom role assignments, or other governance artifacts within the template itself. A deployment of an ARM template can create resources, but it cannot enforce ongoing compliance rules or grant access to users and groups as part of the same package. Azure Blueprints, by contrast, uses ARM templates as one component and layers policy and RBAC on top, making the template alone insufficient for a fully standardized environment.
When this WOULD be correct
A company needs to deploy a consistent set of Azure resources (e.g., VMs, storage) across multiple environments (dev, test, prod) using a repeatable, version-controlled template that can be parameterized for each environment, without requiring policy or role assignment enforcement.
- ✗
Management groups
Why it's wrong here
Management groups serve as hierarchical containers that aggregate subscriptions for centralized governance, such as inheriting Azure Policy assignments and RBAC across an entire organization. However, they are purely organizational structures—they cannot deploy or define infrastructure components like virtual networks or resource groups. A management group does not contain any artifacts that specify what resources should be created, nor does it package policy definitions and role assignments as a deployable unit. Therefore, while management groups enable scaled governance, they do not fulfill the requirement of deploying a standardized environment.
When this WOULD be correct
A company needs to apply common Azure Policy definitions and role assignments across multiple subscriptions without deploying any resources. Management groups would be the correct feature to assign these governance elements at scale.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure BlueprintsCorrect answer▾
Why this is correct
Azure Blueprints allows you to define a repeatable set of Azure resources (including resource groups, virtual networks), policies, and role assignments as a single, versioned artifact. This package can be deployed consistently to multiple subscriptions and updated over time.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy only enforces compliance rules (e.g., allowed locations) but does not deploy resources like resource groups or virtual networks, nor does it package resources, policies, and role assignments as a single versioned item.
★ When this WOULD be the correct answer
A company needs to enforce compliance rules (e.g., restrict allowed VM SKUs or require tags) across existing and future resources without deploying any infrastructure. Azure Policy would be the correct answer for a governance-only requirement.
Why candidates choose this
Candidates see 'Azure Policy definitions to restrict allowed deployment locations' in the question and assume Azure Policy is the primary feature, overlooking that the requirement includes deploying resources and packaging everything as a single versioned item.
✗ARM templatesWrong answer — click to see why▾
Why this is wrong here
ARM templates define infrastructure as code but lack built-in capabilities to enforce policy definitions and role assignments as a single, versioned package across multiple subscriptions; they require separate deployment of policies and roles.
★ When this WOULD be the correct answer
A company needs to deploy a consistent set of Azure resources (e.g., VMs, storage) across multiple environments (dev, test, prod) using a repeatable, version-controlled template that can be parameterized for each environment, without requiring policy or role assignment enforcement.
Why candidates choose this
Candidates may confuse ARM templates with Azure Blueprints because both can deploy resources, but they overlook that Blueprints specifically package policies and role assignments alongside resources for governance.
✗Management groupsWrong answer — click to see why▾
Why this is wrong here
Management groups organize subscriptions hierarchically for governance, but they do not define or deploy a repeatable, versioned package of resources, policies, and role assignments as a single item.
★ When this WOULD be the correct answer
A company needs to apply common Azure Policy definitions and role assignments across multiple subscriptions without deploying any resources. Management groups would be the correct feature to assign these governance elements at scale.
Why candidates choose this
Candidates may confuse management groups with blueprints because both are used for governance across subscriptions, but management groups lack the ability to deploy and version resources like virtual networks.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.