Question 656 of 981
AZ-900 Describe Azure management and governance Practice Question
A company has multiple Azure subscriptions for different departments. The IT team wants to apply a common set of policies (e.g., allowed VM sizes) and assign the same role-based access control (RBAC) permissions across all subscriptions automatically. Which Azure feature should they use?
⚠ Common exam trap
Candidates often confuse Azure Policy (which enforces rules) with Management Groups (which provide the hierarchical scope to apply both policies and RBAC across subscriptions), leading candidates to pick Azure Policy because they focus only on the 'common set of policies' part of the question while ignoring the RBAC requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Management Groups
Azure Management Groups allow you to organize Azure subscriptions hierarchically and apply governance conditions, such as RBAC assignments and Azure Policy definitions, at the management group level. These conditions are inherited by all subscriptions within the group, enabling automatic and consistent application of policies and permissions across multiple subscriptions without manual per-subscription configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is not the mechanism for grouping subscriptions; it is a rule-enforcement engine that evaluates resources for compliance against policy definitions. While you can assign a policy to a management group to affect multiple subscriptions, that assignment is only possible because the management group already exists as the grouping boundary. Azure Policy cannot by itself aggregate independent subscriptions into a single logical unit, so it fails to fulfill the primary requirement of organizing the IT department's subscriptions.
When this WOULD be correct
A company wants to enforce specific compliance rules (e.g., restrict VM SKUs) across all subscriptions without managing RBAC permissions. In that scenario, Azure Policy would be correct because it focuses solely on policy enforcement, not RBAC assignment.
- ✓
Azure Management Groups
Why this is correct
Azure Management Groups are the correct answer because they form a hierarchical container above subscriptions, allowing you to organize multiple subscriptions by department or environment. When you assign Azure Policy or RBAC at a management group level, those assignments are inherited by every subscription and resource group underneath, providing governance at scale. This inherent inheritance is exactly what the scenario needs, unlike the other options that either require per-subscription assignment or lack grouping capability.
- ✗
Azure Blueprints
Why it's wrong here
Azure Blueprints is incorrect because Blueprints is a packaging service that bundles artifacts like Azure Policy definitions, RBAC assignments, and ARM templates into a single, repeatable blueprint. However, each blueprint must be explicitly assigned to a target subscription (or to a management group), and it does not create a hierarchical grouping that automatically governs all current and future subscriptions. The blueprint itself is a definition, while management groups are the actual containers that provide inheritance across subscriptions without additional per-subscription work.
When this WOULD be correct
A scenario where Azure Blueprints would be correct: A company needs to deploy a standardized environment (e.g., a secure development environment) that includes a specific set of resources, policies, and RBAC assignments in a consistent manner across multiple subscriptions. Blueprints enable packaging and deploying these components as a single unit.
- ✗
Azure Resource Manager (ARM) templates
Why it's wrong here
Azure Resource Manager (ARM) templates are infrastructure-as-code files that declaratively define the resources to deploy into a particular resource group or subscription. They are designed for repeatable deployment, not for ongoing governance, and they do not natively apply Azure Policy or RBAC assignments across many subscriptions in one operation. ARM templates could be used to deploy resources into each subscription, but they offer no hierarchical grouping or inheritance, making them unsuitable for centrally managing multiple subscriptions.
When this WOULD be correct
An exam question asking: 'A company needs to deploy a standardized set of resources (e.g., VMs, storage) with the same configuration to multiple Azure subscriptions. Which feature should they use?' would make ARM templates correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Management GroupsCorrect answer▾
Why this is correct
Azure Management Groups are the correct answer because they form a hierarchical container above subscriptions, allowing you to organize multiple subscriptions by department or environment. When you assign Azure Policy or RBAC at a management group level, those assignments are inherited by every subscription and resource group underneath, providing governance at scale. This inherent inheritance is exactly what the scenario needs, unlike the other options that either require per-subscription assignment or lack grouping capability.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy applies individual policy definitions to enforce rules, but it does not automatically assign RBAC permissions across multiple subscriptions. The question requires a feature that applies both policies and RBAC assignments, which Management Groups provide by allowing inheritance.
★ When this WOULD be the correct answer
A company wants to enforce specific compliance rules (e.g., restrict VM SKUs) across all subscriptions without managing RBAC permissions. In that scenario, Azure Policy would be correct because it focuses solely on policy enforcement, not RBAC assignment.
Why candidates choose this
Candidates confuse Azure Policy with Management Groups because both can apply rules at scale, but they overlook that the question explicitly requires assigning RBAC permissions, which Policy cannot do.
✗Azure BlueprintsWrong answer — click to see why▾
Why this is wrong here
Azure Blueprints is used to orchestrate the deployment of resource templates, policies, and RBAC assignments, but it does not automatically apply a common set of policies and RBAC permissions across all subscriptions. Management Groups are designed to manage multiple subscriptions hierarchically and apply policies and RBAC at scale.
★ When this WOULD be the correct answer
A scenario where Azure Blueprints would be correct: A company needs to deploy a standardized environment (e.g., a secure development environment) that includes a specific set of resources, policies, and RBAC assignments in a consistent manner across multiple subscriptions. Blueprints enable packaging and deploying these components as a single unit.
Why candidates choose this
Candidates may confuse Blueprints with Management Groups because both can apply policies and RBAC, but Blueprints is more about deploying a complete environment package, not just applying policies and RBAC across existing subscriptions.
✗Azure Resource Manager (ARM) templatesWrong answer — click to see why▾
Why this is wrong here
ARM templates are used for deploying infrastructure as code, not for applying policies or RBAC permissions across multiple subscriptions automatically.
★ When this WOULD be the correct answer
An exam question asking: 'A company needs to deploy a standardized set of resources (e.g., VMs, storage) with the same configuration to multiple Azure subscriptions. Which feature should they use?' would make ARM templates correct.
Why candidates choose this
Candidates may confuse ARM templates with Azure Blueprints, thinking templates can also enforce policies and RBAC, but templates only deploy resources, not governance settings.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.