AZ-900 Describe Azure management and governance Practice Question
A company wants to ensure that whenever a new Azure subscription is created, it automatically inherits a set of baseline policies, role assignments, and resource groups. Which Azure tool should they use to package and deploy these governance components consistently?
⚠ Common exam trap
Many exam-takers confuse Azure Policy with Azure Blueprints because both involve policies, but Blueprints is the only tool that packages and deploys a full set of governance components (including resource groups and role assignments) as a single, repeatable unit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Blueprints
Azure Blueprints is the correct tool because it is specifically designed to orchestrate the deployment of a repeatable set of Azure resources, policies, role assignments, and resource groups into a new subscription. It packages these governance components into a single blueprint definition that can be assigned to a subscription, ensuring consistent inheritance and compliance from creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Blueprints
Why this is correct
Azure Blueprints is the only service that creates a single, versioned, orchestrated package containing Azure Policy assignments, RBAC role assignments, and resource groups. It can be assigned directly to a new subscription at creation time, so the blueprint's governance artifacts are deployed together in a consistent, repeatable way. Blueprints also support versioning, locking, and lifecycle control, making them the correct mechanism for ensuring new subscriptions start with the required governance baseline.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is limited to enforcing compliance rules on resources, such as disallowing certain SKUs or requiring tags. It evaluates and audits resources after they exist, and while policy initiatives can bundle multiple policies, they cannot deploy role assignments or resource groups. Since the goal is to deploy a cohesive set of governance artifacts when a subscription is created, Azure Policy alone cannot satisfy that requirement.
When this WOULD be correct
A company needs to enforce specific compliance rules (e.g., allowed VM SKUs, tagging requirements) across all existing and new resources in a subscription. Azure Policy would be the correct tool to define and assign these rules.
- ✗
Azure Management Groups
Why it's wrong here
Azure Management Groups provide hierarchical organization for subscriptions, enabling conditional access to Azure, and can inherit policy or RBAC assignments from higher levels. However, management groups are not a deployment mechanism; they do not create resource groups, deploy policy assignments, or automatically provision a governance package. You could place a new subscription into a management group, but that does not 'ensure' that governance artifacts are deployed to the subscription itself.
When this WOULD be correct
A company wants to apply the same set of policies and role assignments across multiple subscriptions based on their organizational structure (e.g., department or environment). Azure Management Groups would be correct to enforce governance at scale by inheriting policies and RBAC assignments to all subscriptions within a group.
- ✗
Azure Resource Manager templates
Why it's wrong here
Azure Resource Manager (ARM) templates are JSON files that declaratively define Azure resources, but they must be explicitly submitted via a deployment command or pipeline. While an ARM template can include a Microsoft.Authorization/policyAssignments resource and role assignment definitions, it does not provide the orchestrated, versioned, lifecycle-managed baseline that Blueprints offers. Also, an ARM template is not automatically triggered by the creation of a new subscription unless externally wired to an event, so it is not the native governance packaging mechanism.
When this WOULD be correct
A company needs to deploy a standardized set of virtual machines, storage accounts, and networking resources repeatedly across multiple environments (e.g., dev, test, prod) with consistent configuration. ARM templates would be the correct tool to define and deploy these resources as code.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure BlueprintsCorrect answer▾
Why this is correct
Azure Blueprints is the only service that creates a single, versioned, orchestrated package containing Azure Policy assignments, RBAC role assignments, and resource groups. It can be assigned directly to a new subscription at creation time, so the blueprint's governance artifacts are deployed together in a consistent, repeatable way. Blueprints also support versioning, locking, and lifecycle control, making them the correct mechanism for ensuring new subscriptions start with the required governance baseline.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy only enforces individual rules on existing resources; it cannot package and deploy a set of baseline components (policies, role assignments, resource groups) together as a single deployable artifact.
★ When this WOULD be the correct answer
A company needs to enforce specific compliance rules (e.g., allowed VM SKUs, tagging requirements) across all existing and new resources in a subscription. Azure Policy would be the correct tool to define and assign these rules.
Why candidates choose this
Candidates often confuse Azure Policy with Azure Blueprints because both involve governance, but they don't realize Blueprints is a higher-level orchestration tool that packages multiple components, while Policy only handles individual rules.
✗Azure Management GroupsWrong answer — click to see why▾
Why this is wrong here
Azure Management Groups organize subscriptions hierarchically but do not package and deploy governance components like policies, role assignments, and resource groups. They are a management layer, not a deployment artifact.
★ When this WOULD be the correct answer
A company wants to apply the same set of policies and role assignments across multiple subscriptions based on their organizational structure (e.g., department or environment). Azure Management Groups would be correct to enforce governance at scale by inheriting policies and RBAC assignments to all subscriptions within a group.
Why candidates choose this
Candidates may confuse Management Groups with Blueprints because both are used for governance at scale, but Management Groups only provide hierarchical organization and inheritance, not the ability to package and deploy a complete set of resources and configurations.
✗Azure Resource Manager templatesWrong answer — click to see why▾
Why this is wrong here
Azure Resource Manager (ARM) templates are used to deploy infrastructure as code, but they do not enforce governance inheritance across subscriptions. They lack the built-in versioning, assignment, and update capabilities that Azure Blueprints provide for packaging policies, role assignments, and resource groups as a single deployable artifact.
★ When this WOULD be the correct answer
A company needs to deploy a standardized set of virtual machines, storage accounts, and networking resources repeatedly across multiple environments (e.g., dev, test, prod) with consistent configuration. ARM templates would be the correct tool to define and deploy these resources as code.
Why candidates choose this
Candidates may confuse ARM templates with Blueprints because both involve deploying resources and policies, but ARM templates are more commonly used for resource deployment, leading to the misconception that they can also handle governance inheritance.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Blueprint
A blueprint in IT certification is a document that outlines the topics, skills, and weighting for an exam, telling you exactly what to study.
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.