A company has 15 Azure subscriptions organized under multiple management groups. The security team has defined a standard set of 8 Azure Policy definitions that must be applied to every subscription. These definitions enforce required tags, deny creation of public IPs, require encryption for storage accounts, and restrict VM SKUs. The team wants to assign these policies as a single entity to simplify management and ensure consistent compliance. What should the team create and assign?

An Azure Blueprint containing the policy definitions

Azure Blueprints can package policy definitions along with other Azure resources (e.g., resource groups, RBAC assignments, ARM templates). However, Blueprints are being deprecated in favor of deployment stacks and templates, and they are more than what is needed here. For simply grouping policy definitions for assignment, an initiative is the appropriate service.

An Azure Policy assignment for each individual definition at the root management group

Assigning each definition individually is possible but does not meet the requirement to manage them as a single entity. This approach increases administrative overhead because each assignment must be managed separately, and compliance reporting is fragmented.

An Azure Resource Manager template that deploys the policy definitions

An ARM template can deploy policy definitions and their assignments, but it does not provide a native grouping mechanism like an initiative. After deployment, each policy assignment remains separate, and you cannot manage them as a single unit in the Azure portal or SDK.

What does this AZ-900 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: An Azure Policy initiative (policy set definition) containing the policy definitions — An Azure Policy initiative (also called a policy set definition) allows you to group multiple independent policy definitions into a single set. Assigning the initiative to a scope (e.g., a management group or subscription) ensures all policies are evaluated together. This simplifies management and reporting because you assign one object instead of eight separate policy assignments. Azure Blueprints can also include policies, but they are a more comprehensive deployment tool that also provisions Azure resources, role assignments, and resource groups. For the specific goal of grouping policies for assignment, an initiative is the correct and simplest solution.

What should I do if I get this AZ-900 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.