The answer is to upgrade the blueprint assignment on the existing subscriptions. This is correct because Azure Blueprints are designed to enforce compliance through versioned artifacts; when you publish a new version, existing subscriptions do not automatically inherit changes—you must explicitly upgrade the assignment to apply the latest role assignments, policies, and resource templates. On the AZ-900 exam, this tests your understanding of blueprint lifecycle management versus resource deployment, often appearing as a trap where candidates mistakenly think new versions auto-propagate. A common memory tip is to think of a blueprint like a building plan: publishing a new revision doesn’t rebuild the house unless you actively update the construction order. Remember the key action: “Upgrade the assignment” to sync old subscriptions with new blueprint versions.
AZ-900 Describe Azure management and governance Practice Question
This AZ-900 practice question tests your understanding of describe azure management and governance. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has created an Azure Blueprint to define a standard environment with role assignments and policies. They have published multiple versions. They want all existing subscriptions that were created from an older version to automatically receive the updates from the latest version. What should they do?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Upgrade the blueprint assignment on the existing subscriptions
Option B is correct because Azure Blueprints allow you to update assignments on existing subscriptions to the latest published version. When you upgrade the blueprint assignment, it applies any new role assignments, policies, or artifacts defined in the newer version to the target subscriptions, ensuring they remain compliant with the updated standard environment.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Create a new subscription from the latest blueprint version
Why it's wrong here
This only affects new subscriptions, not existing ones.
✓
Upgrade the blueprint assignment on the existing subscriptions
Why this is correct
Upgrading an assignment applies the latest published version of the blueprint to the subscription.
Related concept
Read the scenario before looking for a memorised answer.
✗
Reassign the blueprint to the subscriptions
Why it's wrong here
Reassigning would create a duplicate assignment; the correct action is to upgrade the existing assignment.
✗
Nothing, updates apply automatically
Why it's wrong here
Updates are not automatic; you must manually upgrade the assignment.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume blueprint updates are automatically applied to existing subscriptions (like a linked template), but Azure Blueprints require an explicit upgrade action to propagate changes, similar to how Azure Policy assignments must be updated separately.
Detailed technical explanation
How to think about this question
Azure Blueprints use a versioning system where each published version is immutable. When you upgrade an assignment, Azure compares the latest version's artifacts (e.g., policies, role assignments) with the current assignment and applies only the differences, minimizing disruption. This is similar to how Azure Policy uses 'deployIfNotExists' effects, but Blueprints orchestrate multiple resource types together. In real-world scenarios, organizations often publish multiple versions to enforce evolving compliance requirements (e.g., adding a new tagging policy) and must manually trigger upgrades on existing subscriptions to avoid configuration drift.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-900 question in full detail.
Describe Azure management and governance — This question tests Describe Azure management and governance — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Upgrade the blueprint assignment on the existing subscriptions — Option B is correct because Azure Blueprints allow you to update assignments on existing subscriptions to the latest published version. When you upgrade the blueprint assignment, it applies any new role assignments, policies, or artifacts defined in the newer version to the target subscriptions, ensuring they remain compliant with the updated standard environment.
What should I do if I get this AZ-900 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Azure Blueprints to define a standard environment. They publish a new version of the blueprint with an updated role assignment. All existing subscriptions that were created from an older version need to receive the new role assignment. What should they do?
hard
A.Reassign the blueprint to each subscription manually
B.The blueprint updates automatically
C.Manually add the role assignment to each subscription
✓ D.Use the 'Update existing assignments' option
Why D: Option D is correct because Azure Blueprints provides a built-in 'Update existing assignments' option that propagates changes from a published blueprint version to all existing assigned subscriptions. This ensures that updated role assignments are applied without manual intervention, maintaining consistency across the environment.
Variation 2. A company uses Azure Blueprints to define a standard environment with policies, role assignments, and resource groups. They publish a new version of the blueprint that adds a new role assignment. However, existing subscriptions created from older versions do not have this new role assignment. What must they do to apply the update to existing subscriptions?
hard
A.Delete and recreate the subscriptions using the new blueprint.
B.The blueprint version update is automatically applied to all existing subscriptions.
C.They must manually assign the role to each subscription.
✓ D.They need to update the existing blueprint assignment to use the latest published version.
Why D: Azure Blueprints assignments are not automatically updated when a new version of the blueprint is published. To apply the new role assignment to existing subscriptions, you must update the existing blueprint assignment to reference the latest published version. This triggers Azure to evaluate and apply the changes defined in the new version, including the new role assignment, to the assigned subscriptions.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.