A multinational company uses Azure management groups to organize its subscriptions. The company has a root management group (tenant root group) containing three child management groups: 'Finance', 'HR', and 'IT'. Each child management group contains multiple subscriptions. The global governance team needs to enforce an Azure Policy that restricts all resource deployments across every subscription in the organization to only the 'West US' and 'East US' regions. The policy must automatically apply to any new subscriptions that are created under any management group in the future. The team wants to assign the policy once and have it affect all current and future subscriptions with minimal administrative overhead. At which Azure scope should the team assign the policy?

Each subscription individually

Assigning the policy to each subscription individually would require many assignments and would not automatically apply to new subscriptions unless the team also updates the assignments. This is not the most efficient approach for a single, organization-wide policy.

Each child management group (Finance, HR, IT) individually

While assigning to each child management group would cover their respective subscriptions, it requires three separate assignments and will not automatically cover any additional management groups added later. The question specifies assigning the policy once.

A single resource group

Assigning the policy at a resource group scope only affects resources within that specific resource group, not the subscriptions or management groups. This would not meet the requirement to restrict deployments across the entire organization.

What does this AZ-900 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: The root management group — Azure Policy can be assigned at the management group, subscription, or resource group scope. Assigning a policy at the root management group (tenant root group) applies the policy to all child management groups and all subscriptions within them. This ensures that the policy is enforced across the entire organization, including any new subscriptions added in the future, with a single assignment. Assigning at each child management group individually would require multiple assignments and would not cover new management groups. Assigning at each subscription individually is highly inefficient and may miss new subscriptions. Assigning at a resource group scope would only affect resources within that specific resource group, not the whole organization.

What should I do if I get this AZ-900 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.