Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Azure Management Group Policy Inheritance Across Subscriptions
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization manages multiple Azure subscriptions across different business units. The cloud governance team needs to enforce a security policy across all current and future subscriptions to ensure that non-compliant resource configurations are audited organization-wide without requiring manual policy assignments on each separate subscription.
At which level of the Azure management hierarchy should the team assign this policy?
Explanations
Individual resource
Individual resource
What an Individual Resource Is
An individual resource represents a single manageable service instance in Azure, such as a virtual machine, virtual network, SQL database, or storage account.
Why It Doesn't Meet the Requirement
The resource level represents the lowest tier in the Azure management scope hierarchy:
- Applying settings or policies directly to an individual resource only impacts that exact item.
- It provides zero inheritance to other resources, resource groups, or subscriptions.
- Managing governance at the individual resource level is unscalable and contradicts the requirement for automated organization-wide policy enforcement.
Key Characteristics and Limitations
- Lowest scope level: Sits at the bottom of the management hierarchy under resource groups.
- No child entities: Individual resources do not have child containers to propagate policies down to.
- High administrative overhead: Requires per-instance configuration and monitoring, making centralized compliance impossible at scale.
This Answer Would Be Correct If
This option would be correct if the requirement was to apply a specific resource lock or individual tag to a single mission-critical database to prevent accidental deletion.
Additional Context
Azure Policy evaluates individual resources to assess their compliance status, but policies are meant to be assigned at higher scopes (management groups, subscriptions, or resource groups) rather than individually configured per resource.
Resource group
Resource group
What Resource Groups Are
A resource group is a logical container deployed within an Azure subscription to manage and organize related Azure resources such as virtual machines, web apps, and storage accounts that share a common lifecycle.
Why It Doesn't Meet the Requirement
A resource group sits below both management groups and subscriptions in the Azure hierarchy:
- Policies applied to a resource group affect only the resources inside that specific group.
- Other resource groups within the same subscription or across different subscriptions do not inherit these settings.
- Using resource groups for organization-wide governance would require manually creating and maintaining duplicate policy assignments across hundreds of individual containers.
Key Characteristics and Limitations
- Lifecycle boundary: Resources inside a resource group should generally be deployed, updated, and deleted together.
- Single parent subscription: A resource group belongs exclusively to one subscription.
- No upward inheritance: Governance settings defined on a resource group cannot propagate upward or across sibling resource groups.
This Answer Would Be Correct If
This option would be correct if the governance team needed to apply a policy strictly to a single application environment or project container, rather than across all subscriptions in the organization.
Additional Context
Resource groups are best suited for organizing resources by environment (such as Development, Testing, or Production) or application lifecycle rather than establishing broad enterprise-wide governance.
Management group
Management group
What Management Groups Are
Management groups are containers in the Azure resource hierarchy that provide a governance scope above multiple Azure subscriptions. They allow organizations to efficiently manage access, policies, and compliance across multiple subscriptions by grouping them into a unified hierarchical structure.
How It Meets the Organization's Requirement
In Azure's four levels of management scope (management groups, subscriptions, resource groups, and resources), settings applied at higher levels automatically flow down to lower levels through inheritance:
- When a policy is assigned to a management group, all child management groups, subscriptions, resource groups, and resources beneath it inherit the policy automatically.
- By placing all business unit subscriptions under a parent management group and assigning the policy at that scope, the governance team avoids manually configuring the policy on individual subscriptions.
- Any new subscription added to the management group in the future will immediately inherit the policy.
Key Advantages and Capabilities
- Centralized governance: Enforce policies and compliance standards consistently across multiple subscriptions.
- Hierarchical structuring: Create up to six levels of depth to reflect organizational structures or business divisions.
- Scalable access control: Assign Azure Role-Based Access Control (Azure RBAC) roles at the management group level to grant administrative access across all child subscriptions.
- Automated compliance inheritance: Automatically apply policies to new subscriptions provisioned under the group.
Why This Is Optimal
Applying governance at the management group level eliminates administrative overhead and the risk of configuration drift, ensuring consistent security and policy enforcement across the entire enterprise cloud footprint.
Subscription
Subscription
What an Azure Subscription Is
An Azure subscription is a fundamental unit of management, billing, and identity boundary that links user accounts to the Azure resources they provision.
Why It Doesn't Meet the Requirement
While assigning a policy at the subscription level does apply that policy to all child resource groups and resources inside that particular subscription, it fails to meet the broader organizational requirement:
- The scenario specifies that the organization has multiple subscriptions across different business units.
- A policy assigned to one subscription does not cross subscription boundaries.
- Setting policies at the subscription level would require the governance team to repeat the assignment across every current subscription and remember to manually configure it for every newly created subscription.
Key Characteristics and Limitations
- Billing boundary: Subscriptions serve as the primary level for cost tracking and invoice generation.
- Single-scope policy boundary: Policies assigned at a subscription scope only propagate downward to resources within that specific subscription.
- Child of management groups: Subscriptions can be grouped under management groups for unified governance.
This Answer Would Be Correct If
This option would be correct if the organization had only one single subscription, or if the policy rule applied exclusively to a single specialized subscription (such as a sandbox or trial environment).
Additional Context
To achieve true multi-subscription policy enforcement without redundant administrative effort, subscriptions should be organized under a common management group where the policy can be applied once.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Subscription Quota Increase Request
Describe subscriptions
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Cost Management Budgets and Cost Alerts
Describe subscriptions
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Subscription Isolation
Describe subscriptions
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Cost Management Budgets
Describe subscriptions
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Storage Customer-Managed Keys
Describe storage account options and storage types
IntermediateAZ-800 Administering Windows Server Hybrid Core Infrastructure Exam
Azure File Sync Event Logs and Azure Monitor
Configure and manage Azure File Sync
Last updated Validated