AZ-900 Describe Azure management and governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Assign the role at the tenant root management group level

  Why it's wrong here

  Assigning the role at the tenant root management group would apply the permission to every subscription in the entire Azure AD tenant, not just those under the Production management group. This violates the principle of least privilege because development, testing, and other unrelated workloads would also inherit the role. The correct scope is the Production management group itself, which sits below root in the hierarchy and only contains the intended subscriptions.

  When this WOULD be correct

  If the question required the role to be applied to ALL subscriptions across the entire tenant (including future ones), assigning at the tenant root management group would be correct.

• ✓

  Assign the role at the management group level

  Why this is correct

  Assigning the role at the management group level is the correct approach because Azure RBAC role assignments on a management group are inherited by all subscriptions beneath it in the hierarchy. This includes any new subscriptions added to that management group in the future, so access remains consistent automatically. By selecting the specific management group that represents the Production hierarchy, you precisely scope the role to the intended subscriptions without affecting other environments.

• ✗

  Assign the role at each subscription individually

  Why it's wrong here

  Assigning the role directly to each subscription requires manual effort for every current and future subscription and is prone to errors and omissions. Because subscriptions are separate, there is no inheritance between them, so the role would have to be recreated each time a new subscription under Production is created. This approach also makes it harder to audit and consistently govern resources across a large enterprise compared to a single management group assignment.

  When this WOULD be correct

  This option would be correct if the requirement was to assign the role only to specific existing subscriptions without affecting any future subscriptions, and there was no management group hierarchy in place.

• ✗

  Use an Azure Blueprint to assign the role

  Why it's wrong here

  Azure Blueprints can include an RBAC role assignment artifact, but the blueprint must be assigned to each subscription individually. When you assign a blueprint, you specify the subscription scope; therefore, a future subscription will not receive the role unless you explicitly assign the blueprint to it as well. Blueprints also require ongoing management of the blueprint assignment lifecycle and cannot be used to enforce dynamic inheritance across a management group's existing and future subscriptions.

  When this WOULD be correct

  A question where the requirement is to deploy a consistent set of resources (e.g., virtual networks, policies, role assignments) across multiple subscriptions, and ensure that any new subscriptions added later also get those resources deployed automatically. In that case, an Azure Blueprint would be the correct tool.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”