AZ-900 Describe Azure management and governance Practice Question
Which Azure feature allows you to organize resources into logical groups for billing, management, and access control purposes?
⚠ Common exam trap
Candidates often confuse Azure Resource Groups with Azure Subscriptions, as both are used for organization and billing, but subscriptions are the billing boundary and contain multiple resource groups, while resource groups are the logical grouping mechanism within a subscription.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Resource Groups
Azure Resource Groups are logical containers that hold related resources for an Azure solution. They enable you to manage resources collectively, apply consistent access control policies via RBAC, and track costs at the group level. This directly supports organizing resources for billing, management, and access control purposes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Subscriptions
Why it's wrong here
An Azure subscription is a billing and access-control boundary that represents an agreement with Microsoft to use Azure services, and it contains one or more resource groups. Subscriptions are used to manage costs, Azure quota limits, and administrative access at a top level, but they do not directly organize individual resources. Instead, resources are placed into resource groups within a subscription, so a subscription is too coarse-grained to serve as the primary organization mechanism.
- ✗
Azure Management Groups
Why it's wrong here
Management groups are hierarchical containers that sit above Azure subscriptions and allow you to apply governance, policy, and access control across multiple subscriptions. They do not directly organize individual resources like virtual machines or storage accounts; instead, resources reside inside resource groups within a subscription. Thus, choosing management groups as the primary organizer for deployed resources confuses the hierarchical level where resources actually live.
- ✓
Azure Resource Groups
Why this is correct
A resource group is a logical container for holding related Azure resources, such as virtual machines, app services, and databases, so that you can manage them as a single unit. Resource groups enable granular role-based access control, cost aggregation, and the ability to apply policies or locks to all contained resources. Every Azure resource must belong to exactly one resource group, making it the correct answer for organizing resources.
- ✗
Azure Blueprints
Why it's wrong here
Azure Blueprints are a deployment orchestration service that defines a repeatable set of governance artifacts, including policies, role assignments, and ARM templates, to create a standardized environment. Although a blueprint can instantiate resource groups and resources, its role is to automate environment setup rather than to serve as the ongoing organizational container for managing individual resources. After deployment, resources are still organized and operated through resource groups, not through the blueprint object itself.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.