AZ-900 Describe Azure management and governance Practice Question
What is the primary purpose of Azure subscriptions?
⚠ Common exam trap
A common mix-up: candidates confuse Azure subscriptions with Azure AD tenants or virtual networks, leading candidates to select authentication or networking options instead of recognizing the subscription's core role as a billing and access boundary.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To serve as the billing unit and access boundary for Azure resources
Azure subscriptions serve as the primary billing unit, aggregating resource usage into a single invoice, and as an access boundary where Azure RBAC policies and management groups define administrative scope. Without a subscription, resources cannot be deployed or tracked for cost. This dual role makes B correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To provide a private network for Azure resources
Why it's wrong here
Azure Subscriptions do not provide private networking; that is the function of Azure Virtual Network (VNet), which enables isolated network segments, subnets, and private IP addressing within a region. A subscription is a logical container for billing and access, not a network abstraction, and it cannot route traffic or offer IP-level isolation.
- ✓
To serve as the billing unit and access boundary for Azure resources
Why this is correct
An Azure subscription serves as both the billing unit and an access boundary for all resources it contains. All usage from resources within a subscription is aggregated into a single invoice, and Azure RBAC permissions assigned at the subscription scope apply to every resource in it. This dual role makes the subscription the primary management and cost-control boundary in Azure.
- ✗
To authenticate users accessing Azure resources
Why it's wrong here
Subscriptions do not authenticate users; authentication is performed by Azure Active Directory (Microsoft Entra ID), which issues security tokens after validating credentials. A subscription is associated with a tenant and uses that tenant's identity for authorization decisions, but it has no mechanism for verifying user identity. Confusing authentication with authorization often leads to this incorrect answer.
- ✗
To enforce compliance policies across resource groups
Why it's wrong here
Enforcing compliance policies is the role of Azure Policy, which audits or denies non-compliant resource configurations when policies are assigned. A subscription is simply one of the scopes (management group, subscription, resource group) to which Azure Policy can be applied, but the subscription itself does not enforce anything. The actual enforcement engine is separate from the container that holds the policy assignment.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.