AZ-900 Describe Azure management and governance Practice Question
A company has multiple Azure subscriptions. They need to enforce a rule that only specific virtual machine sizes (e.g., Standard_D2s_v3) can be used across all subscriptions. They also want this rule to automatically apply to any future subscriptions created. Which Azure service should they use?
⚠ Common exam trap
Watch out — candidates often confuse Azure Policy (which enforces rules on resource properties) with Azure Blueprints (which packages multiple resources for deployment) or RBAC (which controls user permissions), but the question specifically requires automatic enforcement across all subscriptions, which only Azure Policy with management group assignment can achieve.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy
Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules (such as allowed virtual machine SKUs) across your Azure environment. By assigning a built-in or custom policy definition (e.g., 'Allowed virtual machine SKUs') at the management group scope, the rule automatically applies to all existing and future subscriptions within that management group, ensuring consistent governance without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Policy
Why this is correct
Azure Policy is the correct answer because it is the service specifically designed to enforce organizational standards and audit resource compliance. Policies can evaluate existing and newly deployed resources against definitions such as permitted VM sizes, with effects like deny or audit. When assigned at a management group scope, the policy assignment cascades to all subscriptions and resource groups within that hierarchy, ensuring consistent enforcement across multiple subscriptions. This native governance capability is exactly what is needed to restrict VM sizes across the environment.
- ✗
Azure Blueprints
Why it's wrong here
Incorrect. Azure Blueprints orchestrates the deployment of resources and policies together but does not automatically enforce rules on existing subscriptions unless the blueprint is assigned. Policies are a component of blueprints, but the direct enforcement service is Azure Policy.
When this WOULD be correct
A company needs to deploy a standardized environment that includes a resource group, a virtual network, and a set of policies (like allowed VM sizes) across multiple subscriptions, and they want to version and update this environment as a single unit. Azure Blueprints would be the correct answer because it packages policies, role assignments, and resource templates together.
- ✗
Azure Role-Based Access Control (RBAC)
Why it's wrong here
Azure Role-Based Access Control (RBAC) is incorrect because it governs identity and permissions, not resource configuration. RBAC determines who can perform actions on resources by assigning roles to users, groups, or service principals at specific scopes, but it does not validate or enforce resource properties such as VM size. A role could allow creating virtual machines, but RBAC cannot deny a specific VM SKU or mandate a standard size. Configuring allowed VM sizes requires Azure Policy, which evaluates the resource itself, not the actor's permissions.
When this WOULD be correct
A company needs to grant a specific user group the ability to create virtual machines only in a particular resource group, while denying them access to other resources. Azure RBAC would be used to assign the appropriate role (e.g., Virtual Machine Contributor) scoped to that resource group.
- ✗
Azure Resource Manager
Why it's wrong here
Azure Resource Manager (ARM) is incorrect because, while it is the control plane for deploying, updating, and managing Azure resources, it does not enforce configuration rules or standards. ARM processes API requests and maintains resource lifecycles, but it has no mechanism to evaluate resources against policies like allowed VM sizes. Policy enforcement is external to ARM; Azure Policy interacts with ARM but acts as a separate governance layer. Therefore, ARM alone cannot restrict VM sizes across subscriptions.
When this WOULD be correct
Azure Resource Manager would be the correct answer if the question asked: 'Which service provides a consistent management layer for deploying, managing, and organizing resources in Azure?' or 'Which service enables you to deploy resources using templates and manage resource groups?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure PolicyCorrect answer▾
Why this is correct
Azure Policy is the correct answer because it is the service specifically designed to enforce organizational standards and audit resource compliance. Policies can evaluate existing and newly deployed resources against definitions such as permitted VM sizes, with effects like deny or audit. When assigned at a management group scope, the policy assignment cascades to all subscriptions and resource groups within that hierarchy, ensuring consistent enforcement across multiple subscriptions. This native governance capability is exactly what is needed to restrict VM sizes across the environment.
✗Azure BlueprintsWrong answer — click to see why▾
Why this is wrong here
Azure Blueprints is used to orchestrate the deployment of resource templates and policy assignments, but it does not enforce rules on VM sizes across subscriptions; it relies on Azure Policy for enforcement. The question asks for a service that enforces a rule, not one that packages policies.
★ When this WOULD be the correct answer
A company needs to deploy a standardized environment that includes a resource group, a virtual network, and a set of policies (like allowed VM sizes) across multiple subscriptions, and they want to version and update this environment as a single unit. Azure Blueprints would be the correct answer because it packages policies, role assignments, and resource templates together.
Why candidates choose this
Candidates may confuse Azure Blueprints with Azure Policy because both can involve policies, but Blueprints is about orchestration and repeatable environments, not just enforcement. The word 'enforce' in the question misleads them into thinking a blueprint can enforce rules directly.
✗Azure Role-Based Access Control (RBAC)Wrong answer — click to see why▾
Why this is wrong here
Azure RBAC manages permissions for who can access resources, not what resources can be created. It cannot enforce rules on which VM sizes are allowed across subscriptions.
★ When this WOULD be the correct answer
A company needs to grant a specific user group the ability to create virtual machines only in a particular resource group, while denying them access to other resources. Azure RBAC would be used to assign the appropriate role (e.g., Virtual Machine Contributor) scoped to that resource group.
Why candidates choose this
Candidates may confuse access control (who can do what) with governance (what resources are allowed). RBAC is a common tool for managing Azure, so it seems plausible for enforcing restrictions.
✗Azure Resource ManagerWrong answer — click to see why▾
Why this is wrong here
Azure Resource Manager is the deployment and management service for Azure resources, but it does not provide policy enforcement or governance rules. It cannot restrict VM sizes across subscriptions or automatically apply rules to new subscriptions.
★ When this WOULD be the correct answer
Azure Resource Manager would be the correct answer if the question asked: 'Which service provides a consistent management layer for deploying, managing, and organizing resources in Azure?' or 'Which service enables you to deploy resources using templates and manage resource groups?'
Why candidates choose this
Candidates may confuse Azure Resource Manager with a governance tool because it is central to resource management, but it lacks the policy enforcement capabilities needed for this scenario.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.