A company has five Azure subscriptions, each managed by a different department. The IT governance team needs to enforce a single set of compliance policies (e.g., allowed VM SKUs) and assign a specific role to a central security team across all subscriptions. The goal is to minimize administrative overhead. Which Azure component should the governance team use as the scope for these assignments?

Assign the policies and role at each subscription level individually.

This option is possible but not efficient because it requires repeating the same assignments across five subscriptions, increasing administrative overhead and potential for inconsistencies.

Create a resource group in each subscription and assign policies and roles at the resource group level.

Resource groups exist within a single subscription and cannot span subscriptions. This approach would not apply assignments to all subscriptions from a single point; you would still need to manage each subscription separately.

Create an Azure Blueprint definition and apply it to each subscription separately.

Azure Blueprints are designed for orchestrating the deployment of resource templates, policies, and role assignments. However, to apply a blueprint to multiple subscriptions, you must create a separate blueprint assignment for each subscription, which creates more overhead than using a management group.

What does this AZ-900 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Place all subscriptions under a single management group and assign policies and roles at that management group level. — A management group is a container that helps you manage access, policy, and compliance across multiple subscriptions. By placing all subscriptions under a single management group, you can assign Azure Policy initiatives and Azure RBAC roles at the management group level, and those assignments are inherited by all subscriptions within that management group. This minimizes administrative overhead compared to assigning policies and roles individually to each subscription. Resource groups are too granular and do not span subscriptions; assigning at each subscription individually is not efficient; Azure Blueprints can be used for deploying repeatable environments but require separate assignments per subscription, creating more overhead than a single management group assignment.

What should I do if I get this AZ-900 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.