AZ-900 Describe Azure management and governance Practice Question
A company has three departments: Sales, Marketing, and IT. Each department has its own Azure subscription. The IT department manages all networking and security policies across all subscriptions. The Sales and Marketing departments should be able to create and manage their own resources but cannot modify networking or security policies. The IT department wants to apply a consistent set of policies (e.g., enforce tagging, restrict VM SKUs) across all subscriptions without needing to assign policies to each subscription individually. Additionally, the IT department wants to delegate administration of a specific custom role to a junior administrator who can assign that role to users within the Sales subscription only. Which combination of Azure governance features should the IT department use?
⚠ Common exam trap
Candidates often confuse management groups with resource groups or assume that Azure Blueprints (Option B) are required for policy inheritance, when in fact management groups alone provide the necessary hierarchical policy assignment and RBAC scoping.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a management group containing all three subscriptions, assign Azure Policy initiatives at the management group, and use Azure RBAC with a custom role scoped to the Sales subscription.
Azure management groups allow hierarchical policy inheritance: assigning an Azure Policy initiative at the management group level automatically applies it to all child subscriptions (Sales, Marketing, IT). This satisfies the requirement for consistent policies without individual assignment. Additionally, Azure RBAC with a custom role scoped to the Sales subscription enables the IT department to delegate administration of that role to a junior administrator, who can then assign it only within the Sales subscription, meeting the delegation requirement precisely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a management group containing all three subscriptions, assign Azure Policy initiatives at the management group, and use Azure RBAC with a custom role scoped to the Sales subscription.
Why this is correct
This is the correct approach because Azure management groups provide hierarchical governance above subscriptions, allowing a single Azure Policy initiative assignment at the management group scope to apply automatically to all three child subscriptions. Placing all three subscriptions under one management group centralizes policy enforcement, while Azure RBAC remains independent of management groups and can be configured with a custom role whose assignable scope is limited to the Sales subscription. This separation means the custom role grants delegated administration only to Sales, without affecting Marketing or IT, and the policy initiative requiring, for example, specific resource tags or allowed locations applies uniformly across all departments. The combination leverages Azure's native inheritance model for policies and the granular, subscription-scoped access control of RBAC.
- ✗
Create a management group for each department, assign Azure Policy initiatives at each management group, and use Azure Blueprints to manage role assignments.
Why it's wrong here
Creating separate management groups per department does not reduce the number of policy assignments; each group would need its own assignment. Azure Blueprints can include role assignments, but they are not the primary mechanism for cross-subscription policy inheritance or delegation.
When this WOULD be correct
This option would be correct if each department required independent policy sets (e.g., different allowed VM SKUs per department) and the IT department needed to deploy a consistent set of resources (like a network topology) across subscriptions using Blueprints, while delegating role management per department.
- ✗
Use Azure Resource Manager templates to deploy policies and role assignments to each subscription, and use Azure Active Directory administrative units to manage delegation.
Why it's wrong here
ARM templates can deploy resources, but they do not provide a hierarchical governance structure to automatically apply policies to multiple subscriptions. Administrative units are for managing users and groups in Azure AD, not for Azure RBAC delegation at subscription scope.
When this WOULD be correct
This option would be correct if the question required deploying identical infrastructure and policies to multiple subscriptions in a repeatable manner, and the delegation needed to be managed at the Azure AD level for user administration, not Azure resource role assignment.
- ✗
Assign Azure Policy initiatives to each subscription individually, and create a custom role that is scoped to the management group.
Why it's wrong here
Assigning policies to each subscription individually duplicates effort and does not leverage Azure's hierarchical management capabilities. Scoping a custom role to the management group would grant permissions across all subscriptions, which is broader than the requirement of restricting delegation to the Sales subscription only.
When this WOULD be correct
This option would be correct if the question required applying different policies to each subscription (e.g., each department has unique compliance needs) and the custom role needed to be available across all subscriptions for a global administrator.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a management group containing all three subscriptions, assign Azure Policy initiatives at the management group, and use Azure RBAC with a custom role scoped to the Sales subscription.Correct answer▾
Why this is correct
This is the correct approach because Azure management groups provide hierarchical governance above subscriptions, allowing a single Azure Policy initiative assignment at the management group scope to apply automatically to all three child subscriptions. Placing all three subscriptions under one management group centralizes policy enforcement, while Azure RBAC remains independent of management groups and can be configured with a custom role whose assignable scope is limited to the Sales subscription. This separation means the custom role grants delegated administration only to Sales, without affecting Marketing or IT, and the policy initiative requiring, for example, specific resource tags or allowed locations applies uniformly across all departments. The combination leverages Azure's native inheritance model for policies and the granular, subscription-scoped access control of RBAC.
✗Create a management group for each department, assign Azure Policy initiatives at each management group, and use Azure Blueprints to manage role assignments.Wrong answer — click to see why▾
Why this is wrong here
Using separate management groups per department and assigning policies at each group duplicates effort and does not enable consistent policy application across all subscriptions from a single point. Azure Blueprints manage role assignments but do not replace the need for a single management group for unified policy assignment.
★ When this WOULD be the correct answer
This option would be correct if each department required independent policy sets (e.g., different allowed VM SKUs per department) and the IT department needed to deploy a consistent set of resources (like a network topology) across subscriptions using Blueprints, while delegating role management per department.
Why candidates choose this
Candidates may think separate management groups provide better isolation and that Blueprints can enforce policies, but they overlook that the requirement is for a single consistent policy set across all subscriptions, which is best achieved with a single management group.
✗Use Azure Resource Manager templates to deploy policies and role assignments to each subscription, and use Azure Active Directory administrative units to manage delegation.Wrong answer — click to see why▾
Why this is wrong here
Azure Resource Manager templates and Azure AD administrative units do not provide a centralized, consistent policy assignment across multiple subscriptions without individual assignment, and administrative units are for user/group management within Azure AD, not for Azure resource governance.
★ When this WOULD be the correct answer
This option would be correct if the question required deploying identical infrastructure and policies to multiple subscriptions in a repeatable manner, and the delegation needed to be managed at the Azure AD level for user administration, not Azure resource role assignment.
Why candidates choose this
Candidates may think ARM templates are the only way to enforce consistency across subscriptions, and confuse Azure AD administrative units with Azure RBAC scoping, leading them to choose this option despite its inapplicability to policy assignment and role delegation in this scenario.
✗Assign Azure Policy initiatives to each subscription individually, and create a custom role that is scoped to the management group.Wrong answer — click to see why▾
Why this is wrong here
Assigning Azure Policy initiatives to each subscription individually is inefficient and does not meet the requirement to apply consistent policies across all subscriptions without manual per-subscription assignment. Scoping the custom role to the management group would grant the junior administrator permissions across all subscriptions, not just the Sales subscription.
★ When this WOULD be the correct answer
This option would be correct if the question required applying different policies to each subscription (e.g., each department has unique compliance needs) and the custom role needed to be available across all subscriptions for a global administrator.
Why candidates choose this
Candidates may think that assigning policies individually is simpler or more direct, and they might confuse management group scope with subscription scope for role delegation, not realizing the delegation requirement is subscription-specific.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.