Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Azure Resource Hierarchy From Management Groups to Resources
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise is setting up a multi-department cloud environment in Azure. The governance team needs to ensure that corporate compliance policies and Azure Role-Based Access Control (RBAC) role assignments applied at the highest organization scope automatically cascade downward to all deployed workloads.
Which sequence represents the correct top-to-bottom hierarchy through which Azure policies and permissions flow?
Explanations
Resource groups → Management groups → Subscriptions → Resources
Resource groups → Management groups → Subscriptions → Resources
What This Hierarchy Configuration Represents
This option incorrectly positions Resource groups at the highest level of the hierarchy, with Management groups and Subscriptions nested underneath.
Why It Doesn't Meet the Requirement
Resource groups cannot contain management groups or subscriptions. A resource group is a local container intended strictly for holding individual Azure resources that share an operational lifecycle.
Key Characteristics and Limitations
- Resource group scope: Resource groups exist entirely inside an individual Subscription and cannot span multiple subscriptions or house governance containers.
- No multi-subscription governance: Resource groups have no ability to govern subscriptions or management groups.
- Lifecycle boundary: Resource groups serve as deployment and lifecycle boundaries for services like virtual machines, virtual networks, and databases rather than high-level governance containers.
This Answer Would Be Correct If
This sequence would only make sense if resource groups functioned as top-level organizational units capable of holding multiple billing subscriptions, which is the role of management groups.
Additional Context
Because resource groups reside inside subscriptions, any policy assigned to a resource group applies only to the resources within that specific group, not across the broader subscription or management group.
Management groups → Resource groups → Subscriptions → Resources
Management groups → Resource groups → Subscriptions → Resources
What This Hierarchy Configuration Represents
This option incorrectly swaps the positions of Resource groups and Subscriptions, placing resource groups directly beneath management groups and above subscriptions.
Why It Doesn't Meet the Requirement
Management groups cannot directly contain Resource groups, and Resource groups cannot contain Subscriptions. Subscriptions are the direct child containers of management groups, while resource groups are child containers of subscriptions.
Key Characteristics and Limitations
- Container nesting rules: In Azure Resource Manager, a Management group contains other management groups or subscriptions, but never resource groups directly.
- Subscription role: A Subscription represents the billing and quota boundary in Azure; resource groups are created within subscriptions, not the other way around.
- Inheritance breakage: Inverting subscriptions and resource groups violates the inheritance chain, preventing proper policy flow and cost tracking.
This Answer Would Be Correct If
This hierarchy would be valid if Azure allowed creating resource groups directly at the tenant or management group level to contain billing subscriptions, which is unsupported.
Additional Context
Every Azure resource must be deployed into a resource group, and every resource group must exist within exactly one subscription.
Subscriptions → Management groups → Resource groups → Resources
Subscriptions → Management groups → Resource groups → Resources
What This Hierarchy Configuration Represents
This option incorrectly places Subscriptions above Management groups in the organizational hierarchy.
Why It Doesn't Meet the Requirement
In Azure's architecture, subscriptions cannot contain management groups. Placing subscriptions above management groups inverts the core governance structure and contradicts how Azure handles inheritance.
Key Characteristics and Limitations
- Management groups hold subscriptions: Management groups are designed specifically as containers that sit above Subscriptions to govern multiple subscriptions simultaneously.
- Inheritance direction: Policies and permissions flow downward from management groups to subscriptions, never upward from subscriptions to management groups.
- Parent-Child relationships: A subscription can have exactly one parent management group, meaning it cannot serve as a parent container to a management group.
This Answer Would Be Correct If
This sequence would only be considered if subscriptions served as the primary root container above multi-subscription governance containers, which is not how Azure is architected.
Additional Context
A single Azure tenant can manage up to 10,000 management groups organized in a tree structure above subscriptions to facilitate enterprise-wide governance.
Management groups → Subscriptions → Resource groups → Resources
Management groups → Subscriptions → Resource groups → Resources
What the Azure Governance Hierarchy Is
The Azure resource hierarchy organizes cloud assets into four distinct structural levels: Management groups, Subscriptions, Resource groups, and individual Resources. This hierarchy provides a standardized organizational framework for centralized management, access control, and policy enforcement across an entire organization.
How It Meets the Requirements
- Top-Level Governance: Management groups sit above subscriptions and provide broad governance containers. Applying Azure Policy or Azure RBAC role assignments at a management group ensures all underlying elements inherit those controls.
- Logical Billing & Subscription Boundary: Subscriptions exist directly under management groups, acting as units of billing, quota limits, and administrative boundaries.
- Resource Aggregation: Resource groups exist within subscriptions to group related resources sharing the same operational lifecycle.
- Workload Deployment: Individual Resources (such as virtual machines, storage accounts, and databases) reside inside resource groups, automatically inheriting all policies and permissions applied at each higher level.
Key Advantages and Capabilities
- Cascading Inheritance: Any policy or role assignment assigned at a parent level seamlessly flows down to all child containers and resources.
- Centralized Policy Enforcement: Administrators can enforce compliance rules across hundreds of subscriptions simultaneously without configuring each subscription individually.
- Fine-Grained Access Management: Role assignments can be scoped broadly (at management groups) or narrowly (at individual resources) depending on administrative needs.
- Scalable Administration: Supports complex organization structures across up to six levels of management groups beneath the root management group.
Why This Is Optimal
This top-to-bottom sequence reflects the core architectural design of Azure resource management. Organizing resources in this order ensures that governance policies and security guardrails are applied consistently from high-level management groups down to individual deployed services.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Subscription Billing and Access Boundary
Describe the hierarchy of resource groups, subscriptions, and management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Management Group Policy and RBAC Inheritance
Describe the hierarchy of resource groups, subscriptions, and management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Management Groups
Describe the hierarchy of resource groups, subscriptions, and management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Group
Describe the hierarchy of resource groups, subscriptions, and management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Kubernetes Service
Compare compute types, including containers, virtual machines, and functions
IntermediateAZ-400 Designing and Implementing Microsoft DevOps Solutions Exam
Managed Identity for Azure DevOps Service Connections
Implement and manage Azure DevOps service connections and personalaccess tokens
Last updated Validated