A multinational company has 10 Azure subscriptions, each managed by a different department. The central governance team wants to deploy a standardized environment that includes a specific network topology (virtual network, subnets, and network security groups), a set of Azure Policy definitions to enforce tagging and encryption, and a role assignment granting the 'Reader' role to a central security team in every subscription. The team must be able to update this standard definition in one place, and any changes should automatically apply to all existing deployments that were created from the definition. Which Azure service should they use?

Azure Policy

Azure Policy enforces compliance rules (like tagging and encryption), but it does not deploy resources such as virtual networks or role assignments. It also does not provide a mechanism to deploy and update a complete set of resources across subscriptions in a coordinated, versioned way.

Azure Resource Manager (ARM) templates

ARM templates can deploy resources, policies, and role assignments, but they are static deployments. If the governance team updates the template, they would need to redeploy it to each subscription manually; there is no built-in 'update and automatically apply' feature like Blueprints provides for existing deployments.

Azure Management Groups

Management Groups organize subscriptions hierarchically and can be used to assign policies and RBAC roles at a scope. However, they do not deploy Azure resources like virtual networks or subnets. They are a governance structure, not a deployment service.

What does this AZ-900 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Azure Blueprints — Azure Blueprints enables the central governance team to define a repeatable set of Azure resources, policies, and role assignments that can be deployed consistently across multiple subscriptions. When a blueprint is updated, existing blueprint assignments can be upgraded to apply the changes. This is different from Azure Policy, which only enforces compliance rules but does not deploy resources. ARM templates can deploy resources but lack the automated update capability for existing deployments. Management Groups provide hierarchical organization but do not deploy resources or policies directly.

What should I do if I get this AZ-900 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.