AZ-900 Describe Azure architecture and services Practice Question
A company has three Azure subscriptions: one for the engineering department, one for marketing, and one for finance. The central IT team needs to apply a common set of Azure Policy definitions (e.g., allowed locations for resources) that must be enforced across all three subscriptions. Additionally, each department manager must be able to apply custom policies that only affect their own subscription. The IT team wants to organize the subscriptions into a hierarchy where they can assign the common policy at the top level and delegate custom policy assignment at the subscription level. Which Azure feature should the IT team use to create this hierarchical structure?
⚠ Common exam trap
Many exam-takers confuse Azure Policy (the rule engine) with the hierarchical scope mechanism (management groups) needed to organize subscriptions and enforce policies across them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Management groups
Management groups allow you to create a hierarchical structure of Azure subscriptions, enabling you to assign common Azure Policy definitions (like allowed locations) at a top-level management group that applies to all child subscriptions. Each department subscription can then have its own custom policy assignments, as management groups support inheritance and delegation of policy assignments across the hierarchy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Management groups
Why this is correct
Correct. Management groups allow you to organize Azure subscriptions into a hierarchy for central policy and compliance management. Policies assigned at a management group are inherited by all subscriptions and resource groups under that group.
- ✗
Resource groups
Why it's wrong here
Resource groups are logical containers that hold related Azure resources for a single application or workload, and they exist within exactly one Azure subscription. They cannot contain other subscriptions, nor can they span multiple subscriptions, so they do not provide any cross-subscription hierarchy. Resource groups are therefore a low-level organizational tool and are not the correct answer for grouping subscriptions into a management hierarchy.
When this WOULD be correct
A question asks: 'A company needs to organize all resources for a project into a single container for management and billing. Which Azure feature should they use?' Resource groups would be correct because they group resources with the same lifecycle and management needs.
- ✗
Azure Policy
Why it's wrong here
Incorrect. Azure Policy is the service that creates, assigns, and manages policy definitions to enforce rules on resources. While policies can be assigned at management group, subscription, or resource group scope, Azure Policy itself does not provide the hierarchical container structure needed to organize subscriptions.
When this WOULD be correct
A question that asks: 'Which Azure feature allows you to enforce compliance rules across multiple subscriptions by assigning policies at a scope that applies to all subscriptions?' In that case, Azure Policy would be correct because it is the service used to create and assign policy definitions.
- ✗
Azure role-based access control (RBAC)
Why it's wrong here
Azure RBAC is an authorization system that grants users, groups, or service principals specific roles over Azure resources at defined scopes such as management group, subscription, resource group, or resource. However, it does not create or manage the hierarchical container structure itself; it only governs permissions on top of existing scopes. RBAC cannot be used to group three subscriptions into a tree for centralized policy and compliance management, so this option is incorrect.
When this WOULD be correct
A scenario where the IT team needs to grant specific users (e.g., department managers) the ability to assign policies only to their own subscriptions, while preventing them from modifying policies in other subscriptions. In that case, Azure RBAC would be used to assign the 'Policy Contributor' role at the subscription level.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Management groupsCorrect answer▾
Why this is correct
Correct. Management groups allow you to organize Azure subscriptions into a hierarchy for central policy and compliance management. Policies assigned at a management group are inherited by all subscriptions and resource groups under that group.
✗Resource groupsWrong answer — click to see why▾
Why this is wrong here
Resource groups are containers for resources that share a lifecycle, not a hierarchy for managing multiple subscriptions. They cannot group subscriptions or enforce policies across them.
★ When this WOULD be the correct answer
A question asks: 'A company needs to organize all resources for a project into a single container for management and billing. Which Azure feature should they use?' Resource groups would be correct because they group resources with the same lifecycle and management needs.
Why candidates choose this
Candidates may confuse resource groups with management groups because both involve grouping, but resource groups operate within a single subscription, not across subscriptions.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy is used to define and enforce rules, but it does not create a hierarchical structure for organizing subscriptions. The question asks for a feature to create a hierarchy, which is the role of management groups, not Azure Policy itself.
★ When this WOULD be the correct answer
A question that asks: 'Which Azure feature allows you to enforce compliance rules across multiple subscriptions by assigning policies at a scope that applies to all subscriptions?' In that case, Azure Policy would be correct because it is the service used to create and assign policy definitions.
Why candidates choose this
Candidates may confuse the tool used to enforce rules (Azure Policy) with the organizational structure (management groups) needed to apply those rules hierarchically.
✗Azure role-based access control (RBAC)Wrong answer — click to see why▾
Why this is wrong here
Azure RBAC manages permissions (who can do what), not the hierarchical structure for policy inheritance. The question asks for organizing subscriptions into a hierarchy to enforce policies, which is the purpose of management groups, not RBAC.
★ When this WOULD be the correct answer
A scenario where the IT team needs to grant specific users (e.g., department managers) the ability to assign policies only to their own subscriptions, while preventing them from modifying policies in other subscriptions. In that case, Azure RBAC would be used to assign the 'Policy Contributor' role at the subscription level.
Why candidates choose this
Candidates may confuse RBAC with policy management because both involve controlling access and enforcement. They might think RBAC can create a hierarchy, but RBAC is about identity and permissions, not resource organization.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.