AZ-900 Describe Azure management and governance Practice Question
A company has an Azure tenant with a management group hierarchy. The 'Production' management group contains five subscriptions used by the operations team. The IT security team wants to grant the 'Network Contributor' role to a group of network administrators for all subscriptions under the 'Production' management group. The role assignment must automatically apply to any new subscription added under the 'Production' management group in the future. The network administrators already exist as a security group in Azure AD. What is the most efficient way to achieve this?
⚠ Common exam trap
Many exam-takers confuse Azure Policy with Azure RBAC, thinking Policy can assign roles, when in fact Policy only evaluates and enforces compliance rules, while role assignments must be done through Azure RBAC at the appropriate scope.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the 'Network Contributor' role to the security group at the 'Production' management group scope.
Assigning the 'Network Contributor' role at the 'Production' management group scope is the most efficient method because management groups provide a hierarchical scope that automatically inherits role assignments to all child subscriptions, including any new subscriptions added in the future. This eliminates the need for manual assignments per subscription and ensures consistent access control across the entire management group hierarchy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the 'Network Contributor' role at the scope of each existing subscription individually, and remember to assign it to new subscriptions manually.
Why it's wrong here
This approach requires creating and maintaining separate role assignments for each subscription under Production. Because RBAC assignments do not automatically propagate to future subscriptions, any new subscription added later would be missing the Network Contributor role until manually updated, risking configuration drift and potential security gaps. It also increases administrative overhead compared to a single management group-level assignment, and it does not provide any benefit in terms of least privilege or compliance.
When this WOULD be correct
If the requirement was to grant the role only to specific existing subscriptions without affecting future subscriptions, and the security group needed different permissions per subscription, then individual assignments would be appropriate.
- ✓
Assign the 'Network Contributor' role to the security group at the 'Production' management group scope.
Why this is correct
Role assignments at the management group scope are inherited by all subscriptions within that management group. This single assignment covers all current subscriptions and automatically applies to any new subscriptions added under the 'Production' management group, making it the most efficient method.
- ✗
Create an Azure Policy that assigns the 'Network Contributor' role to the security group for all subscriptions under 'Production'.
Why it's wrong here
Azure Policy is used to enforce compliance rules (e.g., allowed resource types) and can deploy resources via 'deployIfNotExists' effects, but it cannot directly assign RBAC roles to a security group. RBAC role assignments must be made through Azure RBAC, not Azure Policy.
When this WOULD be correct
If the question asked for a way to automatically audit or enforce that a specific role is assigned to a security group for all new subscriptions, an Azure Policy initiative with a 'DeployIfNotExists' effect could be used to create the role assignment automatically.
- ✗
Assign the 'Network Contributor' role to the security group at the root management group scope.
Why it's wrong here
Assigning at the root management group scope would grant the 'Network Contributor' role across all subscriptions in the entire tenant, including non-production subscriptions. This violates the principle of least privilege and grants broader access than required.
When this WOULD be correct
This option would be correct if the question required granting the role to all subscriptions across the entire organization (all management groups) and the security group needed access to all Azure resources, not just those under 'Production'.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign the 'Network Contributor' role to the security group at the 'Production' management group scope.Correct answer▾
Why this is correct
Role assignments at the management group scope are inherited by all subscriptions within that management group. This single assignment covers all current subscriptions and automatically applies to any new subscriptions added under the 'Production' management group, making it the most efficient method.
✗Assign the 'Network Contributor' role at the scope of each existing subscription individually, and remember to assign it to new subscriptions manually.Wrong answer — click to see why▾
Why this is wrong here
This approach requires manual assignment for each existing subscription and does not automatically apply to new subscriptions, failing the requirement for automatic inheritance.
★ When this WOULD be the correct answer
If the requirement was to grant the role only to specific existing subscriptions without affecting future subscriptions, and the security group needed different permissions per subscription, then individual assignments would be appropriate.
Why candidates choose this
Candidates may think that assigning roles at the subscription level is the only way to ensure the role applies to those subscriptions, overlooking the inheritance capability of management groups.
✗Create an Azure Policy that assigns the 'Network Contributor' role to the security group for all subscriptions under 'Production'.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy is used to enforce compliance rules (e.g., tagging, resource types) and cannot directly assign RBAC roles; role assignments are done via Azure RBAC, not Policy.
★ When this WOULD be the correct answer
If the question asked for a way to automatically audit or enforce that a specific role is assigned to a security group for all new subscriptions, an Azure Policy initiative with a 'DeployIfNotExists' effect could be used to create the role assignment automatically.
Why candidates choose this
Candidates may confuse Azure Policy's 'DeployIfNotExists' effect with RBAC role assignment, thinking Policy can directly assign roles, or they overcomplicate the solution when a simple RBAC assignment at the management group scope is sufficient.
✗Assign the 'Network Contributor' role to the security group at the root management group scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning at the root management group scope would grant the role to all subscriptions in the entire Azure tenant, not just those under 'Production', violating the principle of least privilege and not meeting the requirement to scope only to 'Production'.
★ When this WOULD be the correct answer
This option would be correct if the question required granting the role to all subscriptions across the entire organization (all management groups) and the security group needed access to all Azure resources, not just those under 'Production'.
Why candidates choose this
Candidates may think that using a higher scope (root) is more efficient and still covers the 'Production' subscriptions, overlooking that it grants excessive permissions beyond the required scope.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.