easyMultiple ChoiceObjective-mapped
Enable Defender for Cloud Plans at Management Group Level
A company manages multiple Azure subscriptions under a single management group. The security team wants to enable Microsoft Defender for Cloud's enhanced security features (e.g., Defender for Servers) for all subscriptions under that management group with minimal administrative effort. Which method should they use?
Quick Answer
The answer is to enable Defender for Cloud plans at the management group level. This is correct because Defender for Cloud supports policy inheritance through Azure management groups, meaning that enabling a plan—such as Defender for Servers—on a management group automatically applies that enhanced security feature to all current and future subscriptions within that group, eliminating the need for per-subscription configuration. On the SC-200 exam, this scenario tests your understanding of Azure Policy inheritance and how to minimize administrative overhead when securing multiple subscriptions; a common trap is attempting to enable plans individually on each subscription or confusing management group scope with subscription scope. Remember the memory tip: “One group, one enable—future subs, no trouble.”
⚠ Common exam trap
Test-takers frequently think Azure Blueprints or custom policies are required for bulk enablement, but Defender for Cloud natively supports enabling plans at the management group level, which is the simplest and most direct method.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the plans at the management group level
Enabling Microsoft Defender for Cloud's enhanced security features at the management group level applies the plans to all current and future subscriptions under that management group with a single action, minimizing administrative effort. This is the most efficient method because Defender for Cloud supports inheritance of security policies and plans from the management group down to subscriptions, eliminating the need for per-subscription configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable the plans individually on each subscription
Why it's wrong here
This requires manual effort per subscription and does not scale well for new subscriptions.
- ✓
Enable the plans at the management group level
Why this is correct
Correct. Policy and plan assignments at the management group propagate to all child subscriptions.
- ✗
Use Azure Blueprints to assign the plans to each subscription
Why it's wrong here
Azure Blueprints is not the direct mechanism for enabling Microsoft Defender for Cloud plans across a management group hierarchy. While it facilitates defining and assigning consistent configurations, it doesn't natively control the enablement of Defender for Cloud plans at the management group scope, requiring a custom artefact which adds unnecessary complexity. Blueprints are tempting as they enforce standards across subscriptions, and would be suitable for deploying a standardised environment or a compliant landing zone with specific resource deployments and policy assignments.
- ✗
Create a custom Azure Policy that enforces the installation of the Log Analytics agent
Why it's wrong here
This only installs the agent, not the full Defender plan. The plans themselves must be enabled separately.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization has multiple Azure subscriptions and wants to ensure that all of them have Microsoft Defender for Cloud's enhanced security features enabled. What is the minimal step required to achieve this for all subscriptions?
easy- A.Assign an Azure Policy initiative to enable Defender for Cloud on each subscription
- ✓ B.Enable the required Defender for Cloud plans at the management group level
- C.Install the Log Analytics agent on all virtual machines in each subscription
- D.Create a security contact email for each subscription
Why B: Enabling Microsoft Defender for Cloud plans at the management group level is the minimal step because it applies the configuration to all child subscriptions under that management group in a single action. This leverages Azure's hierarchical management structure, ensuring every subscription inherits the enhanced security features without needing individual subscription-level configuration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.