AZ-900 Describe Azure management and governance Practice Question
A global organization wants to apply a consistent set of Azure policies and RBAC roles across all new subscriptions automatically as they are created. Which Azure capability enables this?
⚠ Common exam trap
Many exam-takers confuse Azure Blueprints (which require explicit assignment) with Management Group inheritance (which is automatic), leading them to choose Blueprints for 'automatic' application when inheritance is the correct mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Policy inheritance via Management Groups
Management Groups allow you to apply Azure Policy and RBAC role assignments at the management group level, which are inherited by all subscriptions within that group. When a new subscription is created under the management group, it automatically receives those policies and roles, ensuring consistent governance without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Blueprints deployment
Why it's wrong here
Azure Blueprints is a declarative orchestration service that packages resources, policies, and RBAC assignments into a definable, reusable blueprint. However, applying a blueprint is an explicit manual action: you must publish it and then assign it to a subscription or management group, and it does not automatically execute when a new subscription is created. Because the requirement is for automatic enforcement on every new subscription without manual intervention, Azure Blueprints deployment does not satisfy that condition.
- ✓
Policy inheritance via Management Groups
Why this is correct
Assigning an Azure Policy at a management group scope automatically propagates that policy down to every underlying subscription, including subscriptions that are added to the management group after the assignment is made. This inheritance is transitive and immediate, so all current and future subscriptions in the hierarchy are governed consistently from the moment they join. By using management groups, an organization can enforce baseline policies across the entire environment without needing to configure each subscription individually, which makes this the correct answer.
- ✗
Azure Policy initiatives
Why it's wrong here
An Azure Policy initiative (formerly known as a policy set) is a collection of policy definitions, but it has no effect on its own; it only applies when it is assigned to a specific scope such as a management group, subscription, or resource group. Merely creating an initiative does not automatically apply it to new subscriptions, and unless that initiative is assigned at a management group level (which the option does not state), it will not inherit to newly created subscriptions. Therefore, the presence of an initiative alone is insufficient to guarantee automatic governance on new subscriptions.
- ✗
Subscription tags
Why it's wrong here
Subscription tags are key-value pairs used purely for metadata, organization, and cost management; they do not carry any enforcement logic. Tags cannot apply Azure Policy definitions, deliver RBAC role assignments, or trigger any automatic governance behavior when a new subscription is created. Although tags can be used as a target for policy evaluation (e.g., requiring a certain tag), the tag itself does not enforce anything, so tagging a subscription or management group is not a mechanism for ensuring policies or roles are applied to new subscriptions.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.