AZ-900 Describe Azure management and governance Practice Question
A large enterprise manages Azure subscriptions for three business units: Sales, Research & Development, and Information Technology. Each business unit has its own Azure subscription. The central governance team needs to ensure that a specific set of Azure Policy definitions (e.g., restricting allowed regions to 'East US' only) is applied to all current and future subscriptions belonging to these three business units. The team wants to minimize administrative overhead and ensure that any new subscription created for a business unit automatically inherits the same policies. Which Azure feature should the team use to achieve this goal?
⚠ Common exam trap
Watch out — candidates often confuse management groups with resource groups or Azure Blueprints, thinking that resource groups can span subscriptions or that Blueprints are required for policy inheritance, when in fact management groups provide the simplest and most scalable inheritance mechanism for policy assignments across multiple subscriptions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a management group for each business unit, place the corresponding subscription inside each management group, and assign the policy set to each management group.
Management groups provide a hierarchical structure above subscriptions, allowing Azure Policy assignments to be inherited by all subscriptions within a management group. By placing each business unit's subscription into its own management group and assigning the policy set (initiative) to each management group, the central governance team ensures that any current or future subscription under those management groups automatically inherits the policies, minimizing administrative overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign each policy definition individually to every subscription.
Why it's wrong here
Assigning each policy definition individually to every subscription is highly manual, error-prone, and does not scale across a large enterprise with many subscriptions. Each new subscription requires a separate set of policy assignments, and because there is no inheritance mechanism from one subscription to another, policies must be redeployed to every subscription from scratch. In contrast, management groups use inheritance to propagate policies to all descendant subscriptions, making this approach both inefficient and operationally burdensome.
When this WOULD be correct
This option would be correct if the question asked for a solution to apply policies to a small, fixed set of subscriptions with no expectation of future subscriptions, and the team had no management group hierarchy in place.
- ✓
Create a management group for each business unit, place the corresponding subscription inside each management group, and assign the policy set to each management group.
Why this is correct
Management groups are hierarchical containers that can hold subscriptions, enabling policy assignment at a group level. When you assign a policy set (initiative) to a management group, every subscription inside that group—including future subscriptions added later—inherits the policy via Azure Policy's built-in inheritance model. This centralizes compliance enforcement per business unit and eliminates the need to configure policies individually on each subscription, drastically reducing administrative overhead.
- ✗
Create a single resource group at the tenant root level and assign the policy definitions to that resource group.
Why it's wrong here
Resource groups are logical containers for resources such as virtual machines, storage accounts, and networks, not for subscriptions. There is no such entity as a 'tenant root resource group,' and even if one existed, a policy assigned to a resource group scope only applies to resources within that same resource group—not across multiple subscriptions. Therefore, this approach cannot possibly govern subscriptions or their resources at the tenant level and is fundamentally invalid in the Azure resource hierarchy.
When this WOULD be correct
If the question asked for applying policies to all resources within a single subscription (e.g., to restrict regions for all VMs in that subscription), assigning the policy to a resource group at the subscription root would be correct, as policies can be assigned at the resource group scope.
- ✗
Use Azure Blueprints to deploy a new subscription with the policies, then manually move each existing subscription into the blueprint's management group.
Why it's wrong here
Azure Blueprints are designed to orchestrate the deployment of a consistent environment (including policies) for a single subscription or management group, but they are not the most efficient tool for simply applying policies to existing subscriptions. Manual moving of subscriptions is required and the description adds unnecessary complexity.
When this WOULD be correct
This option would be correct if the question required deploying a new subscription with a predefined set of policies and resources, and then moving existing subscriptions into the same management group to inherit those policies. For example, when setting up a standardized environment for a new business unit that needs a consistent baseline.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a management group for each business unit, place the corresponding subscription inside each management group, and assign the policy set to each management group.Correct answer▾
Why this is correct
Management groups are hierarchical containers that can hold subscriptions, enabling policy assignment at a group level. When you assign a policy set (initiative) to a management group, every subscription inside that group—including future subscriptions added later—inherits the policy via Azure Policy's built-in inheritance model. This centralizes compliance enforcement per business unit and eliminates the need to configure policies individually on each subscription, drastically reducing administrative overhead.
✗Assign each policy definition individually to every subscription.Wrong answer — click to see why▾
Why this is wrong here
Assigning each policy definition individually to every subscription would require manual effort for each subscription and would not automatically apply policies to new subscriptions, failing to minimize administrative overhead as required.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a solution to apply policies to a small, fixed set of subscriptions with no expectation of future subscriptions, and the team had no management group hierarchy in place.
Why candidates choose this
Candidates may think that direct assignment is the simplest approach, overlooking the need for scalability and automatic inheritance across current and future subscriptions.
✗Create a single resource group at the tenant root level and assign the policy definitions to that resource group.Wrong answer — click to see why▾
Why this is wrong here
Resource groups cannot contain subscriptions; they contain resources within a subscription. Assigning policies to a resource group at the tenant root level is not possible because the tenant root is a management group, not a resource group.
★ When this WOULD be the correct answer
If the question asked for applying policies to all resources within a single subscription (e.g., to restrict regions for all VMs in that subscription), assigning the policy to a resource group at the subscription root would be correct, as policies can be assigned at the resource group scope.
Why candidates choose this
Candidates may confuse resource groups with management groups, thinking that a resource group at the tenant root can contain subscriptions, or they may not fully understand the hierarchical scope of Azure Policy assignments.
✗Use Azure Blueprints to deploy a new subscription with the policies, then manually move each existing subscription into the blueprint's management group.Wrong answer — click to see why▾
Why this is wrong here
Azure Blueprints are used to orchestrate the deployment of resource templates and policy assignments, but they do not automatically apply policies to existing subscriptions that are not part of the blueprint. Manually moving subscriptions into a management group is not required; assigning policies at the management group level already ensures inheritance to all current and future subscriptions within that group.
★ When this WOULD be the correct answer
This option would be correct if the question required deploying a new subscription with a predefined set of policies and resources, and then moving existing subscriptions into the same management group to inherit those policies. For example, when setting up a standardized environment for a new business unit that needs a consistent baseline.
Why candidates choose this
Candidates may think Blueprints are the only way to enforce policies across multiple subscriptions, or they may confuse Blueprints with management groups, not realizing that management groups provide automatic inheritance without manual moves.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure subscription
An Azure subscription is a logical container in Microsoft Azure that provides billing isolation and access boundaries for your cloud resources and services.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.