Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
How Management Groups Govern Multiple Subscriptions
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise organization manages dozens of Azure subscriptions across various departments, including dedicated environments for development, testing, and production. The governance team needs a way to organize these subscriptions into a unified hierarchical structure to apply access controls and compliance policies consistently across all subscriptions at scale.
Which Azure architectural component should the organization implement?
Explanations
Network groups
Network groups
What Network Groups Are
Network groups are logical containers used within Azure Virtual Network Manager to group multiple virtual networks (VNets) globally across regions and subscriptions.
Why They Do Not Meet the Requirement
Network groups are specifically designed for orchestrating virtual network topology (such as hub-and-spoke or mesh connectivity) and applying network security admin rules. They do not group subscriptions themselves, nor do they serve as a general-purpose governance hierarchy for overall Azure access control and policy management.
Key Characteristics and Limitations
- Networking specific: Restricted entirely to managing connectivity, routing, and security rules across virtual networks.
- Membership scope: Virtual networks can join statically or dynamically via Azure Policy rules, but the group cannot contain subscriptions.
- Specialized tool: Functions within the scope of Azure Virtual Network Manager rather than acting as a top-level Azure resource hierarchy mechanism.
When This Option Would Be Correct
Network groups are the correct solution when you need to group virtual networks across subscriptions to deploy standardized connectivity configurations or enforce global network security rules.
Microsoft Entra security groups
Microsoft Entra security groups
What Microsoft Entra Security Groups Are
Microsoft Entra security groups are identity containers used within Microsoft Entra ID to group identity objects, such as users, devices, and service principals, to simplify identity and access administration.
Why They Do Not Meet the Requirement
While Microsoft Entra security groups are essential for assigning permissions to collections of users via Azure RBAC, they are identity objects rather than Azure infrastructure hierarchy components. They cannot contain Azure subscriptions, nor do they define the architectural structure of Azure cloud resources.
Key Characteristics and Limitations
- Identity focus: Designed to manage user permissions, application access, and device policies rather than resource hierarchy.
- Membership types: Can be populated manually via assigned membership or dynamically based on user and device attributes.
- No resource containment: Cannot hold Azure subscriptions, resource groups, or cloud infrastructure assets.
When This Option Would Be Correct
Microsoft Entra security groups are ideal when an administrator needs to grant a common set of permissions to a team of users (such as developers or auditors) across designated Azure resources or enterprise applications.
Management groups
Management groups
What Management Groups Are
Management groups are containers in the Azure resource hierarchy positioned above subscriptions. They provide a centralized governance scope that allows organizations to organize multiple subscriptions into a flexible, tree-like hierarchy.
How They Meet the Requirements
By organizing subscriptions into management groups, the organization can:
- Structure subscriptions hierarchically: Align subscriptions by department, business unit, lifecycle stage (such as production versus non-production), or geographic region.
- Inherit governance controls: Any Azure Policy assignments or Azure Role-Based Access Control (RBAC) role definitions applied at a parent management group automatically cascade down to all child management groups, subscriptions, resource groups, and individual resources.
- Scale management efficiently: Instead of duplicating policy and permission assignments across dozens of individual subscriptions, administrators configure rules once at the appropriate management group level.
Key Advantages and Capabilities
- Hierarchical organization: Supports up to six levels of depth beneath the Root Management Group to reflect complex organizational structures.
- Unified policy enforcement: Ensures compliance standards are systematically enforced across all underlying resources.
- Centralized access control: Simplifies permission management by granting user access at a higher structural layer.
- Cost visibility and management: Allows aggregation and tracking of spending patterns across multiple subscriptions.
Why This Is Optimal
Management groups are the only Azure architectural construct designed specifically to manage, group, and govern multiple Azure subscriptions in a parent-child hierarchy, making them the optimal solution for multi-subscription governance.
Resource groups
Resource groups
What Resource Groups Are
An Azure resource group is a logical container deployed within a single subscription that holds related Azure resources, such as virtual machines, storage accounts, virtual networks, and databases.
Why They Do Not Meet the Requirement
Resource groups exist below subscriptions in the Azure management hierarchy. A single resource group can only belong to one subscription and cannot contain or organize multiple subscriptions. Consequently, resource groups cannot be used to build a multi-subscription management hierarchy or apply policies across multiple subscriptions at scale.
Key Characteristics and Limitations
- Subscription boundary: Every resource group must reside entirely within a single Azure subscription.
- Resource lifecycle management: Used primarily to group resources that share the same lifecycle (deployed, updated, and deleted together).
- No upward inheritance: Governance applied to a resource group affects only the resources inside that specific group, not other subscriptions or resource groups.
When This Option Would Be Correct
Resource groups are the correct choice when you need to logically group, deploy, and manage the lifecycle of individual Azure services and assets belonging to a single application within a specific subscription.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Subscription Billing and Access Boundary
Describe the hierarchy of resource groups, subscriptions, and management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Hierarchy
Describe the hierarchy of resource groups, subscriptions, and management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Group
Describe the hierarchy of resource groups, subscriptions, and management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Management Group Policy and RBAC Inheritance
Describe the hierarchy of resource groups, subscriptions, and management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Data at-Rest Encryption Platform-Managed Keys
Describe Azure datacenters
IntermediateAZ-204 Developing Solutions for Microsoft Azure Exam
Azure Blob System Properties vs User-Defined Metadata
Set and retrieve properties and metadata
Last updated Validated