AZ-900 Describe Azure management and governance Practice Question
A company is adopting Azure and wants to ensure that every new subscription automatically includes a standard set of governance artifacts: two custom Azure Policy definitions (one for allowed locations, one for resource tagging), a custom Role-Based Access Control (RBAC) assignment for the security team, and an initial resource group with an Azure Resource Manager (ARM) template that sets up a network topology. The company wants to version these artifacts and update them over time, ensuring that new subscriptions always use the latest approved version. Which Azure service should the company use to package and deploy this standardized environment?
⚠ Common exam trap
It's easy for candidates to confuse Azure Policy Initiatives (which only handle policies) with Azure Blueprints (which package policies, RBAC, templates, and resource groups together), missing the requirement for versioning and multi-artifact deployment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Blueprints
Azure Blueprints is the correct service because it is designed to orchestrate the deployment of a repeatable, versioned environment that includes policies, RBAC assignments, resource groups, and ARM templates. It allows you to define a blueprint with these artifacts, publish versions, and assign the latest approved version to new subscriptions, ensuring consistent governance across the organization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Management Groups
Why it's wrong here
Management Groups organize subscriptions hierarchically to manage governance and compliance, but they do not package or deploy a set of artifacts like policies, RBAC assignments, and templates together. They are a container, not a deployment mechanism.
When this WOULD be correct
A company wants to apply the same set of Azure Policy definitions and RBAC assignments across multiple existing subscriptions without deploying ARM templates or versioning artifacts. Management Groups would be used to assign these policies and roles at scale.
- ✗
Azure Policy Initiatives
Why it's wrong here
Azure Policy Initiatives (also called policy sets) aggregate multiple Azure Policy definitions into a single assignable unit to enforce compliance rules. However, they are strictly limited to policy definitions and cannot include other governance artifacts such as RBAC role assignments, ARM templates, or resource group scaffolding. They also lack the versioning and assignment lifecycle management that Azure Blueprints provides, making them insufficient for provisioning a complete governance baseline across new subscriptions.
When this WOULD be correct
A company needs to enforce a set of related policies (e.g., allowed locations and tagging) across multiple subscriptions, ensuring compliance without deploying additional resources or RBAC. An Azure Policy Initiative would be the correct answer.
- ✓
Azure Blueprints
Why this is correct
Azure Blueprints is the correct service. It allows you to define a repeatable set of Azure resources that follow organizational standards, including policies, role assignments, ARM templates, and resource groups. Blueprints support versioning and can be assigned to management groups or subscriptions to ensure every new environment is automatically provisioned with the approved artifacts.
- ✗
Azure Resource Manager (ARM) Templates
Why it's wrong here
ARM templates deploy infrastructure as code, but they are limited to deploying Azure resources. They do not natively include RBAC assignments (though you can embed some) and lack the versioning and governance assignment capabilities that Blueprints provide for managing a complete governance baseline across multiple subscriptions.
When this WOULD be correct
A question asks: 'A company needs to deploy a standard network topology across multiple regions using a repeatable, parameterized template. Which service should they use?' ARM templates would be correct for deploying infrastructure with parameters.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure BlueprintsCorrect answer▾
Why this is correct
Azure Blueprints is the correct service. It allows you to define a repeatable set of Azure resources that follow organizational standards, including policies, role assignments, ARM templates, and resource groups. Blueprints support versioning and can be assigned to management groups or subscriptions to ensure every new environment is automatically provisioned with the approved artifacts.
✗Azure Management GroupsWrong answer — click to see why▾
Why this is wrong here
Azure Management Groups organize subscriptions hierarchically for policy and access management, but they do not package and deploy a set of governance artifacts (policies, RBAC, ARM templates) as a versioned, updatable blueprint.
★ When this WOULD be the correct answer
A company wants to apply the same set of Azure Policy definitions and RBAC assignments across multiple existing subscriptions without deploying ARM templates or versioning artifacts. Management Groups would be used to assign these policies and roles at scale.
Why candidates choose this
Candidates may confuse Management Groups with Blueprints because both are used for governance at scale, but Management Groups lack the ability to package and deploy multiple artifact types together with versioning.
✗Azure Policy InitiativesWrong answer — click to see why▾
Why this is wrong here
Azure Policy Initiatives group multiple policy definitions together but do not include RBAC assignments, resource groups, or ARM templates; they lack the ability to orchestrate and version a complete environment with non-policy artifacts.
★ When this WOULD be the correct answer
A company needs to enforce a set of related policies (e.g., allowed locations and tagging) across multiple subscriptions, ensuring compliance without deploying additional resources or RBAC. An Azure Policy Initiative would be the correct answer.
Why candidates choose this
Candidates confuse grouping policies (Initiative) with packaging an entire environment (Blueprint), especially when the question emphasizes 'standard set of governance artifacts' and policies are a key component.
✗Azure Resource Manager (ARM) TemplatesWrong answer — click to see why▾
Why this is wrong here
ARM templates can deploy infrastructure but cannot package governance artifacts like Azure Policy definitions and RBAC assignments as a single, versioned, updatable blueprint that applies to new subscriptions automatically.
★ When this WOULD be the correct answer
A question asks: 'A company needs to deploy a standard network topology across multiple regions using a repeatable, parameterized template. Which service should they use?' ARM templates would be correct for deploying infrastructure with parameters.
Why candidates choose this
Candidates know ARM templates are used for deploying Azure resources, and the question mentions an ARM template for network topology, leading them to think ARM templates alone can also handle the governance artifacts and versioning.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
Key term
Blueprint
A blueprint in IT certification is a document that outlines the topics, skills, and weighting for an exam, telling you exactly what to study.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.