AZ-900 Describe Azure management and governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Blueprint

  Why it's wrong here

  Azure Blueprints is a deprecated service that allowed you to orchestrate the deployment of an entire environment, including resource groups, ARM templates, role assignments, and policy assignments, in a repeatable way. While a blueprint could reference or assign a policy initiative, it is a deployment package, not a mechanism specifically for grouping policy definitions. Its primary role is environment composition, not policy aggregation, and Microsoft recommends moving to alternatives such as templates and deployment stacks.

  When this WOULD be correct

  An exam scenario where a company needs to deploy a consistent environment (e.g., a set of VMs, networking, and policies) that can be versioned and updated across multiple subscriptions. In that case, Azure Blueprints would be the correct answer because they package artifacts including policies, role assignments, and resource templates.

• ✓

  Policy Initiative

  Why this is correct

  A Policy Initiative (also called a policy set) in Azure Policy is the correct way to enforce a consistent set of security policies across resources and subscriptions. It groups multiple individual policy definitions into a single assignable unit, allowing you to apply an overarching compliance goal—such as 'Enable Monitoring in Azure Security Center'—to a management group, subscription, or resource group as one entity. This is exactly the intended mechanism for bundling related policies, and when assigned, all included policy definitions are evaluated and enforced together.

• ✗

  Management Group

  Why it's wrong here

  A Management Group is a hierarchical organizational unit used to manage access, policy, and compliance across multiple subscriptions in Azure Enterprise Agreedement or Enterprise Scale scenarios. It enables centralized management of subscriptions and helps apply governance at scale, but it does not itself group policy definitions. Management groups are a scope where policy assignments are applied—not the container that holds the policy definitions; the actual grouping of multiple definitions is performed by an initiative definition.

  When this WOULD be correct

  A company wants to apply the same set of Azure policies and role-based access controls to all subscriptions under a specific department. Which Azure construct should they use to organize subscriptions and apply governance at scale?

• ✗

  Resource Group

  Why it's wrong here

  A Resource Group is a logical container for deploying, managing, and grouping related Azure resources such as virtual machines, storage accounts, and virtual networks. It does not have any native capability to group policy definitions; instead, policy assignments can be scoped to a resource group, meaning policies are applied to the resources within that container, not stored or grouped by it. Thus, a resource group is an object that policies act upon, not a construct for aggregating policies.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question