Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Four Levels of Azure Resource Hierarchy
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise is planning its cloud governance strategy in Azure to manage access, policies, and compliance across multiple business units. The organization wants to establish a clear structural hierarchy to manage its cloud assets effectively from the highest organizational level down to individual services.
Which sequence correctly lists the top-to-bottom hierarchy of Azure resource management scopes?
Explanations
Subscriptions → Management groups → Resource groups → Resources
Subscriptions → Management groups → Resource groups → Resources
What This Option Proposes
This option positions subscriptions above management groups in the organizational hierarchy, followed by resource groups and resources.
Why It Doesn't Meet the Requirement
In Azure's architecture, subscriptions cannot contain management groups. Instead, management groups exist at a higher level than subscriptions to aggregate and govern multiple subscriptions simultaneously. A subscription is always a child container within a management group, not a parent container above it.
Key Characteristics and Limitations
- Container Relationships: Management groups hold subscriptions, but subscriptions hold resource groups.
- Scope Inversion: Placing subscriptions above management groups inverts the core governance structure designed by Azure.
- Inheritance Direction: Governance settings flow downward from management groups to subscriptions, never upward from subscriptions into management groups.
This Answer Would Be Correct If
This structure would only be correct if an individual subscription had the capability to host management group containers, which is architecturally impossible in Azure.
Additional Context
A single Azure tenant starts with a Root Management Group at the highest tier, which encompasses all subscriptions attached to the directory.
Management groups → Subscriptions → Resource groups → Resources
Management groups → Subscriptions → Resource groups → Resources
What Azure Resource Hierarchy Is
The Azure resource hierarchy provides four levels of management scope designed to organize and apply governance across an entire enterprise: management groups, subscriptions, resource groups, and resources.
How It Meets the Structural Requirements
This sequence reflects the accurate top-to-bottom structural flow:
- Management groups: Positioned at the top level, management groups are containers that can hold multiple subscriptions or other child management groups to create a unified tree hierarchy.
- Subscriptions: Nest inside management groups, serving as organizational and billing boundaries for cloud services.
- Resource groups: Nest inside subscriptions as logical containers where related assets are deployed and managed together.
- Resources: Represent the lowest level of the hierarchy, consisting of individual service instances such as virtual machines, storage accounts, and virtual networks.
Key Advantages and Capabilities
- Inherited Governance: Policies, compliance rules, and Azure Role-Based Access Control (RBAC) permissions assigned at a higher level automatically flow down to all child levels.
- Multi-Subscription Management: Enables central administration of hundreds of subscriptions under a single Root Management Group.
- Flexible Nesting: Management groups can be nested up to six levels deep to mirror complex organizational or departmental trees.
- Lifecycle Grouping: Allows development, staging, and production assets to be segregated cleanly across subscriptions and resource groups.
Why This Is Optimal
Understanding this exact four-tier hierarchy ensures administrators can apply policies and access controls at the appropriate scope, minimizing repetitive administrative overhead while preventing security misconfigurations across enterprise assets.
Management groups → Resource groups → Subscriptions → Resources
Management groups → Resource groups → Subscriptions → Resources
What This Option Proposes
This option places resource groups directly under management groups, while placing subscriptions below resource groups.
Why It Doesn't Meet the Requirement
Management groups cannot directly contain resource groups, nor do resource groups contain subscriptions. In Azure, subscriptions sit directly under management groups, and resource groups are created within those subscriptions.
Key Characteristics and Limitations
- Structural Hierarchy: The correct relationship requires subscriptions to contain resource groups, not vice versa.
- Billing and Boundaries: Subscriptions act as the primary billing boundary; resource groups simply organize resources within that billed subscription.
- Management Group Targets: A management group can only contain other child management groups or subscriptions.
This Answer Would Be Correct If
This structure would be valid if resource groups could contain entire subscriptions as child entities, which Azure does not support.
Additional Context
To manage resources effectively, administrators create resource groups inside an active subscription, while management groups govern multiple subscriptions from above.
Resource groups → Management groups → Subscriptions → Resources
Resource groups → Management groups → Subscriptions → Resources
What This Option Proposes
This option places resource groups at the highest tier of the organization, followed by management groups, subscriptions, and individual resources.
Why It Doesn't Meet the Requirement
Resource groups are relatively low-level containers created inside a single subscription. They cannot contain management groups or subscriptions, and they cannot serve as the top-level scope for multi-subscription enterprise governance.
Key Characteristics and Limitations
- Scope Boundary: A resource group is confined to exactly one subscription and cannot span across multiple subscriptions.
- Container Role: Resource groups directly hold individual Azure resources (like virtual machines or web apps), not broader organizational containers.
- Governance Reach: Policies assigned to a resource group affect only the resources deployed within that specific group.
This Answer Would Be Correct If
This arrangement would only apply if resource groups operated as top-level tenant management containers rather than granular deployment boundaries within subscriptions.
Additional Context
Resource groups share the lifecycle of the services deployed inside them, allowing administrators to deploy, update, or delete related application components together.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Management Groups
Describe management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Management Groups
Describe management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Management Group ID vs Display Name
Describe management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Management Groups
Describe management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra ID, Azure RBAC, Azure Key Vault
Define cloud models, including public, private, and hybrid
IntermediateAZ-204 Developing Solutions for Microsoft Azure Exam
Azure Blob System Properties vs User-Defined Metadata
Set and retrieve properties and metadata
Last updated Validated