AZ-900 Describe Azure management and governance Practice Question
An organization wants to ensure that no one can create Azure resources outside of approved geographic locations across all of their subscriptions. What is the most scalable way to enforce this?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Policy with RBAC or Azure Blueprints, leading candidates to choose options that manage permissions or deployments instead of the centralized, policy-based enforcement that Azure Policy provides at the management group scope.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign 'Allowed locations' Azure Policy at the Management Group level
Azure Policy at the Management Group level allows you to define a single 'Allowed locations' policy that applies to all subscriptions within that group, ensuring consistent enforcement across the entire organization. This approach is the most scalable because it centralizes governance, automatically covering new subscriptions added to the management group without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure RBAC to deny resource creation permissions in all subscriptions
Why it's wrong here
RBAC is designed for identity-based access management, not for restricting deployment by resource property. Denying resource creation permissions (for example, by removing the Contributor role) would block all deployments, but it would not allow specific geographic limits—users still granted access could deploy anywhere. Azure Policy's 'Allowed locations' uses a Deny effect on the location property, complementing RBAC by enforcing regional boundaries without altering user permissions. Also, RBAC assignments must be manually scoped to each subscription; management group policy covers all automatically.
- ✓
Assign 'Allowed locations' Azure Policy at the Management Group level
Why this is correct
Assigning the built-in 'Allowed locations' policy at the management group scope propagates to every subscription, resource group, and resource under that management group, including newly created subscriptions. The policy uses a Deny effect to reject any deployment not matching the approved region list, enforcing geographic compliance before resources are provisioned. This creates a single policy assignment that governs the entire Azure AD tenant hierarchy, providing centralized and scalable control.
- ✗
Create separate 'Allowed locations' policies in each subscription
Why it's wrong here
Applying the 'Allowed locations' policy individually to each subscription does achieve location restriction, but it is not scalable across an enterprise with many subscriptions. Each subscription requires its own assignment, which creates duplication, administrative burden, and risks of inconsistent parameters if one subscription is misconfigured. Assigning once at the management group level inherits to all children, avoids repetitive configuration, and automatically covers future subscriptions.
- ✗
Use Azure Blueprints to restrict locations in each new subscription
Why it's wrong here
Azure Blueprints are packaging artifacts that bundle policies, role assignments, and ARM templates, but each blueprint must be explicitly assigned to every subscription. New subscriptions are not automatically covered unless a separate blueprint assignment is created, so this approach incurs manual overhead and does not propagate across the entire hierarchy. A management group policy assignment automatically applies to all current and future subscriptions, making it the more efficient enterprise-wide enforcement method.
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.