Question 565 of 981
AZ-900 Describe Azure management and governance Practice Question
A company has multiple Azure subscriptions for different projects. They want to apply a common set of policies and role assignments to all subscriptions under the 'Research' department. They also plan to add more subscriptions for Research in the future. What should they use?
⚠ Common exam trap
It's easy for candidates to confuse Azure Blueprints (which can package policies and roles) with the management group hierarchy, failing to realize that Blueprints are deployment artifacts that must be assigned to a scope, whereas management groups are the scoping mechanism that inherently applies governance to all nested subscriptions, including future ones.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure management group
Azure management groups allow you to efficiently manage access, policies, and compliance across multiple Azure subscriptions. By placing all 'Research' subscriptions under a single management group, you can apply a common set of Azure Policy assignments and Azure role-based access control (RBAC) assignments at the management group scope, which automatically cascades to all current and future subscriptions within that group. This hierarchical structure is specifically designed for enterprise-scale governance across departments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure management group
Why this is correct
Management groups are hierarchical containers that can hold one or more Azure subscriptions, enabling policies, RBAC assignments, and cost controls to be applied once and inherited across every subscription within the group. Since new subscriptions can be added to a management group and automatically inherit those settings, this is the correct mechanism for centralizing governance across multiple projects without per-subscription manual configuration.
- ✗
Azure resource group
Why it's wrong here
A resource group is a logical container for aggregating resources that share a common lifecycle, such as the components of a single application, but it exists only within a single subscription and cannot span subscriptions. Even if a resource group is in a specific subscription, it provides no mechanism to apply policies or role assignments recursively across multiple subscriptions, so it fails to address cross-subscription governance for multiple projects.
When this WOULD be correct
A company needs to organize resources for a single project within one subscription, applying policies and role assignments specific to that project's resources. The question would ask: 'What should they use to group related resources and apply access control for a single project?'
- ✗
Azure Blueprint
Why it's wrong here
Azure Blueprint is a deployment artifact that packages resource templates, policies, and RBAC assignments to create consistent environments, but it is assigned to an individual subscription and its effect is limited to that deployment. Blueprints do not create a persistent hierarchy that tracks organizational structure, and they do not automatically govern future subscriptions added by the organization, unlike management groups which provide continuous inheritance across a dynamic set of subscriptions.
When this WOULD be correct
A company wants to deploy a standardized environment (e.g., a set of VMs, network, and policies) for a new project, ensuring compliance and consistency across multiple deployments. Azure Blueprints would be correct to package and deploy the entire environment repeatedly.
- ✗
Azure Policy initiative
Why it's wrong here
A Policy initiative is a collection of built-in or custom policy definitions, but it is not an organizational container; it only takes effect when explicitly assigned to an Azure scope such as a subscription or management group. Assigning it to a single subscription does not cover other subscriptions, and even if assigned to a management group, the initiative itself does not organize subscriptions into a hierarchy—management groups are the structural scope that enables inheritance and grouping across multiple subscriptions.
When this WOULD be correct
A company needs to enforce a set of compliance policies (e.g., allowed locations, resource types) across all resources in a subscription or management group. They would use an Azure Policy initiative to group related policies and assign them at the appropriate scope.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure management groupCorrect answer▾
Why this is correct
Management groups are hierarchical containers that can hold one or more Azure subscriptions, enabling policies, RBAC assignments, and cost controls to be applied once and inherited across every subscription within the group. Since new subscriptions can be added to a management group and automatically inherit those settings, this is the correct mechanism for centralizing governance across multiple projects without per-subscription manual configuration.
✗Azure resource groupWrong answer — click to see why▾
Why this is wrong here
Azure resource groups are containers for resources within a single subscription, not for managing policies and role assignments across multiple subscriptions. They cannot apply common governance across different subscriptions or future subscriptions.
★ When this WOULD be the correct answer
A company needs to organize resources for a single project within one subscription, applying policies and role assignments specific to that project's resources. The question would ask: 'What should they use to group related resources and apply access control for a single project?'
Why candidates choose this
Candidates may confuse resource groups with management groups because both are used for organizing resources and applying policies, but resource groups operate at a lower scope within a single subscription.
✗Azure BlueprintWrong answer — click to see why▾
Why this is wrong here
Azure Blueprints are used to create a repeatable set of Azure resources and policies for deploying environments, but they do not natively apply policies and role assignments across multiple subscriptions in a hierarchical manner like management groups do.
★ When this WOULD be the correct answer
A company wants to deploy a standardized environment (e.g., a set of VMs, network, and policies) for a new project, ensuring compliance and consistency across multiple deployments. Azure Blueprints would be correct to package and deploy the entire environment repeatedly.
Why candidates choose this
Candidates may confuse Blueprints with management groups because both involve policies and role assignments, but Blueprints focus on deploying a complete environment rather than managing governance across subscriptions.
✗Azure Policy initiativeWrong answer — click to see why▾
Why this is wrong here
Azure Policy initiatives define a set of policies to enforce compliance, but they do not provide hierarchical management or role assignment across multiple subscriptions. Management groups are needed to apply policies and role assignments at scale across subscriptions.
★ When this WOULD be the correct answer
A company needs to enforce a set of compliance policies (e.g., allowed locations, resource types) across all resources in a subscription or management group. They would use an Azure Policy initiative to group related policies and assign them at the appropriate scope.
Why candidates choose this
Candidates may confuse Policy initiatives with management groups because both can apply policies across multiple subscriptions, but initiatives lack the hierarchical structure and role assignment capabilities of management groups.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.