Using Azure Management Groups to Apply Policies and Roles Across Subscriptions
A company has multiple Azure subscriptions for different projects. They want to apply the same set of Azure policies and role assignments to all subscriptions under a specific department, and they plan to add more subscriptions in the future. Which Azure construct should they use?
Quick Answer
The answer is a management group, because it enables you to apply Azure policies and role assignments across subscriptions in a single, hierarchical structure. When you place all subscriptions for a department under one management group, any Azure Policy or RBAC assignment you set at that group level is automatically inherited by every subscription within it, including any new subscriptions added later. On the AZ-900 exam, this concept tests your understanding of Azure governance hierarchy—management groups sit above subscriptions and below the root tenant, making them the correct tool for cross-subscription policy enforcement. A common trap is confusing management groups with resource groups; remember that resource groups contain resources, not subscriptions. For a quick memory tip, think of a management group as a “policy folder” for subscriptions: whatever you put in the folder applies to everything inside it, now and in the future.
⚠ Common exam trap
Candidates often confuse Azure Policy initiatives or Blueprints as the grouping mechanism, but they are assignment or deployment tools, whereas the management group is the hierarchical container that enables inheritance across subscriptions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Management group
A management group is the correct construct because it allows you to manage governance, policy, and role assignments across multiple Azure subscriptions hierarchically. By placing all subscriptions for a department under a single management group, you can apply the same Azure Policy and role-based access control (RBAC) assignments once, and any new subscriptions added to that group will automatically inherit those settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Management group
Why this is correct
Correct. A management group can contain multiple subscriptions, and any policies or role assignments applied at the management group level are automatically inherited by all child subscriptions.
- ✗
Resource group
Why it's wrong here
Incorrect. Resource groups are containers for resources within a single subscription, not for grouping subscriptions. They cannot apply policies across multiple subscriptions.
When this WOULD be correct
A question asks: 'You need to organize all resources for a specific project, such as virtual machines and databases, into a single container for management and billing. Which Azure construct should you use?' In that case, a resource group is correct.
- ✗
Azure Policy initiative
Why it's wrong here
Incorrect. A policy initiative is a group of policy definitions, but it must be assigned to a scope like a management group, subscription, or resource group. It alone does not organize subscriptions.
When this WOULD be correct
A company wants to enforce a set of compliance policies (e.g., requiring specific resource locations) across all resources in a subscription. They need to group multiple policy definitions into a single assignable package. An Azure Policy initiative would be the correct construct.
- ✗
Azure Blueprint
Why it's wrong here
Incorrect. Blueprints are used to define a repeatable environment (including policies and roles) for a specific subscription, but they are not a construct to group multiple existing subscriptions.
When this WOULD be correct
An exam question might ask: 'A company needs to deploy a standardized environment that includes a virtual network, a storage account, and a set of policies, all defined as a single deployable unit for new subscriptions.' In that case, Azure Blueprint would be the correct answer because it packages resources and policies into a single artifact for repeated deployment.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Management groupCorrect answer▾
Why this is correct
Correct. A management group can contain multiple subscriptions, and any policies or role assignments applied at the management group level are automatically inherited by all child subscriptions.
✗Resource groupWrong answer — click to see why▾
Why this is wrong here
Resource groups are containers for resources within a single subscription, not for managing policies and role assignments across multiple subscriptions. They cannot apply governance settings across subscriptions or to future subscriptions.
★ When this WOULD be the correct answer
A question asks: 'You need to organize all resources for a specific project, such as virtual machines and databases, into a single container for management and billing. Which Azure construct should you use?' In that case, a resource group is correct.
Why candidates choose this
Candidates may confuse resource groups with management groups because both are hierarchical containers, but resource groups operate within a single subscription and lack cross-subscription governance capabilities.
✗Azure Policy initiativeWrong answer — click to see why▾
Why this is wrong here
Azure Policy initiatives are used to group related policies together and apply them at a scope, but they do not provide hierarchical management for multiple subscriptions or support for adding new subscriptions under a department. Management groups are designed for that purpose.
★ When this WOULD be the correct answer
A company wants to enforce a set of compliance policies (e.g., requiring specific resource locations) across all resources in a subscription. They need to group multiple policy definitions into a single assignable package. An Azure Policy initiative would be the correct construct.
Why candidates choose this
Candidates may confuse the ability to apply policies across subscriptions with the need for a policy grouping construct, not realizing that management groups handle subscription hierarchy and policy inheritance.
✗Azure BlueprintWrong answer — click to see why▾
Why this is wrong here
Azure Blueprint is used to create a repeatable set of Azure resources that adhere to organizational standards, but it does not natively apply policies and role assignments across multiple subscriptions under a single management hierarchy. Management groups are the correct construct for hierarchical policy and role assignment across subscriptions.
★ When this WOULD be the correct answer
An exam question might ask: 'A company needs to deploy a standardized environment that includes a virtual network, a storage account, and a set of policies, all defined as a single deployable unit for new subscriptions.' In that case, Azure Blueprint would be the correct answer because it packages resources and policies into a single artifact for repeated deployment.
Why candidates choose this
Candidates may confuse Azure Blueprint with management groups because both can apply policies, but Blueprints also include resource templates and role assignments, leading them to think it can manage multiple subscriptions when it actually deploys into a single subscription per blueprint assignment.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has multiple Azure subscriptions for different projects. They want to apply a common set of policies and role assignments to all subscriptions under the 'Research' department. They also plan to add more subscriptions for Research in the future. What should they use?
medium- ✓ A.Azure management group
- B.Azure resource group
- C.Azure Blueprint
- D.Azure Policy initiative
Why A: Azure management groups allow you to efficiently manage access, policies, and compliance across multiple Azure subscriptions. By placing all 'Research' subscriptions under a single management group, you can apply a common set of Azure Policy assignments and Azure role-based access control (RBAC) assignments at the management group scope, which automatically cascades to all current and future subscriptions within that group. This hierarchical structure is specifically designed for enterprise-scale governance across departments.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.