AZ-900 Describe Azure management and governance Practice Question
A company has multiple departments, each with its own Azure subscription. They want to apply the same set of policies and role assignments to all subscriptions under the Sales department. They also plan to create more subscriptions for Sales in the future. Which Azure construct should they use?
⚠ Common exam trap
Many exam-takers confuse policy initiatives (which are collections of policies) with the management group scope that actually enables hierarchical inheritance across multiple subscriptions, leading them to choose 'Policy initiative' instead of 'Management group'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Management group
Management groups allow you to apply Azure Policy and role-based access control (RBAC) assignments hierarchically across multiple subscriptions. By placing all Sales department subscriptions under a single management group, any policies or role assignments defined at that management group level will be inherited by all current and future subscriptions within it, ensuring consistent governance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Resource group
Why it's wrong here
Resource groups are logical containers for grouping related Azure resources that share a common lifecycle, such as a single application's components, and they operate only within the scope of a single subscription. They cannot contain or manage more than one subscription, and they do not inherit policies or RBAC from a higher level that could span multiple subscriptions. Therefore, while resource groups are useful for organizing resources, they are insufficient for managing a fleet of departmental subscriptions collectively.
When this WOULD be correct
A question asks: 'You need to organize all resources for a project into a single unit for billing and access control. Which Azure construct should you use?' Resource groups would be correct because they group resources within a subscription for management purposes.
- ✓
Management group
Why this is correct
Management groups serve as hierarchical containers in the Azure governance structure, explicitly designed to hold one or more subscriptions. They provide a top-down scope for assigning Azure Policy and Role-Based Access Control (RBAC) that automatically propagates to every child subscription, making them the correct choice when each department has its own subscription that must be managed under a common governance umbrella. Management groups also support multiple levels of hierarchy, allowing organizations to reflect departmental structures while maintaining centralized control over compliance and access.
- ✗
Policy initiative
Why it's wrong here
A policy initiative, such as the built-in 'Microsoft Cloud Security Benchmark', is a collection of individual policy definitions intended to group related compliance rules so they can be assigned together. However, an initiative itself is not a management scope; it must be assigned to an existing scope like a subscription, resource group, or management group. It does not create a subscription hierarchy or provide a mechanism to contain and manage multiple subscriptions, so it cannot satisfy the requirement of handling each department's separate subscription as a unified governance unit.
When this WOULD be correct
A company needs to enforce a set of compliance policies (e.g., allowed locations, required tags) across all resources in a subscription. They want to group these policies into a single assignable unit. In this scenario, a policy initiative would be the correct answer.
- ✗
Blueprint
Why it's wrong here
Azure Blueprints (now deprecated in favor of templates and deployment stacks) were used to define a repeatable set of Azure resources, policies, and RBAC assignments to deploy a new environment. A blueprint is applied to a single subscription at a time, and it does not dynamically govern or contain multiple existing subscriptions going forward. Although it could enforce policies during initial deployment, it lacks the persistent, hierarchical relationship needed to manage multiple departments' subscriptions under a single administrative scope.
When this WOULD be correct
A company needs to deploy a standardized environment (including policies, role assignments, and resource templates) for a new project, ensuring compliance and repeatability across multiple resource groups within a single subscription. Blueprints would be the correct answer because they package and deploy these components together.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Management groupCorrect answer▾
Why this is correct
Management groups serve as hierarchical containers in the Azure governance structure, explicitly designed to hold one or more subscriptions. They provide a top-down scope for assigning Azure Policy and Role-Based Access Control (RBAC) that automatically propagates to every child subscription, making them the correct choice when each department has its own subscription that must be managed under a common governance umbrella. Management groups also support multiple levels of hierarchy, allowing organizations to reflect departmental structures while maintaining centralized control over compliance and access.
✗Resource groupWrong answer — click to see why▾
Why this is wrong here
Resource groups are containers for resources within a single subscription, not for managing policies and role assignments across multiple subscriptions. They cannot apply governance across subscriptions.
★ When this WOULD be the correct answer
A question asks: 'You need to organize all resources for a project into a single unit for billing and access control. Which Azure construct should you use?' Resource groups would be correct because they group resources within a subscription for management purposes.
Why candidates choose this
Candidates may confuse resource groups with management groups because both are used for organizing resources, but resource groups operate at a lower scope and cannot aggregate subscriptions.
✗Policy initiativeWrong answer — click to see why▾
Why this is wrong here
A policy initiative is a collection of policy definitions that can be assigned to a scope, but it does not manage subscriptions or apply role assignments across multiple subscriptions. The question requires a construct that groups subscriptions and applies policies and roles hierarchically, which is the function of a management group.
★ When this WOULD be the correct answer
A company needs to enforce a set of compliance policies (e.g., allowed locations, required tags) across all resources in a subscription. They want to group these policies into a single assignable unit. In this scenario, a policy initiative would be the correct answer.
Why candidates choose this
Candidates may confuse policy initiatives with management groups because both can apply policies at scale. They might think a policy initiative can be assigned to multiple subscriptions directly, not realizing that management groups are needed to organize subscriptions first.
✗BlueprintWrong answer — click to see why▾
Why this is wrong here
Blueprints are used to deploy and manage a set of Azure resources (like policies, role assignments, and resource templates) as a single, versioned package. They do not provide a hierarchical structure to group multiple subscriptions for applying policies and role assignments across them; management groups are designed for that purpose.
★ When this WOULD be the correct answer
A company needs to deploy a standardized environment (including policies, role assignments, and resource templates) for a new project, ensuring compliance and repeatability across multiple resource groups within a single subscription. Blueprints would be the correct answer because they package and deploy these components together.
Why candidates choose this
Candidates may confuse Blueprints with management groups because both can apply policies and role assignments, but Blueprints are deployment artifacts for a specific scope, not a hierarchical grouping construct for subscriptions.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.