Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Azure Resource Manager as the Unified Control Plane
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An IT department manages cloud infrastructure using multiple interfaces, including the Azure portal, Azure CLI, Azure PowerShell scripts, and automated REST API calls.
Which Azure service serves as the central, unified management layer that handles all control plane requests and applies access control, locks, and governance policies across these tools?
Explanations
Microsoft Entra ID
Microsoft Entra ID
What Microsoft Entra ID Is
Microsoft Entra ID (formerly Azure Active Directory) is a cloud-based identity and access management service that manages user identities, security principals, groups, application registrations, and authentication tokens.
Why It Doesn't Meet the Requirement
Microsoft Entra ID provides identity verification and issues OAuth bearer tokens to authenticate requests. However, it does not manage Azure infrastructure resources, interpret deployment templates, execute resource provisioning, or enforce infrastructure management locks.
Key Characteristics and Limitations
- Authenticates users and applications, issuing access tokens used in REST API calls.
- Houses user profiles, security groups, and service principals.
- Works alongside Azure Resource Manager by handling identity authentication, while ARM handles resource authorization and management execution.
This Answer Would Be Correct If
The scenario focused specifically on the identity provider used to authenticate administrators and applications before they issue commands to Azure.
Additional Context
Administrators authenticate with Microsoft Entra ID to obtain a security token, which is then passed in the Authorization header to Azure Resource Manager.
Azure Resource Manager
Azure Resource Manager
What Azure Resource Manager Is
Azure Resource Manager (ARM) is the central deployment and management service for Microsoft Azure. It functions as the comprehensive control plane layer through which all resource operations—such as creating, configuring, updating, and deleting infrastructure—are processed.
How It Meets the Requirements
ARM acts as a unified management layer by providing a consistent interface regardless of the management tool used. When an administrator or script submits a request via the Azure portal, Azure CLI, Azure PowerShell, or directly through the REST API, the request is routed to the ARM endpoint (https://management.azure.com). ARM authenticates the caller, evaluates Azure role-based access control (Azure RBAC) permissions, enforces Azure Policy rules, and verifies Management Locks before delegating the operation to the appropriate service resource provider.
Key Advantages and Capabilities
- Consistent Management Interface: Ensures that commands executed in PowerShell, the CLI, the portal, or SDKs produce identical outcomes.
- Declarative Deployments: Supports Infrastructure as Code (IaC) through ARM templates and Bicep files for repeatable, idempotent provisioning.
- Centralized Governance: Automatically applies security policies, access boundaries, and tag metadata across all managed resources.
- Resource Group Organization: Enables logical grouping and lifecycle management of related resources as a single administrative unit.
Why This Is Optimal
Azure Resource Manager is the only architectural component in Azure designed to serve as the unified gateway for all control plane actions, ensuring uniform security, audit logging, and policy compliance across every tool.
Azure Storage resource provider
Azure Storage resource provider
What the Azure Storage Resource Provider Is
The Azure Storage resource provider (Microsoft.Storage) is a specialized backend service responsible specifically for managing Azure Storage accounts and related storage management entities.
Why It Doesn't Meet the Requirement
A resource provider only manages resources within its specific domain (such as storage accounts, containers, and access keys). It does not provide a general management layer for all Azure resources (like compute, networking, or databases), nor does it receive requests directly from management tools before ARM processes them.
Key Characteristics and Limitations
- Implements CRUD (create, read, update, delete) operations solely for storage resources.
- Receives instructions from Azure Resource Manager after ARM has authorized and validated the incoming request.
- Does not manage cross-service governance tools like management locks, global RBAC scopes, or general subscription policies.
This Answer Would Be Correct If
The requirement specifically asked for the underlying service component that provisions and configures storage accounts when instructed by Azure Resource Manager.
Additional Context
Each Azure service has its own dedicated resource provider (e.g., Microsoft.Compute, Microsoft.Network) that acts downstream from Azure Resource Manager.
Azure Policy
Azure Policy
What Azure Policy Is
Azure Policy is a governance service in Azure that evaluates resource configurations against defined organizational rules and standards, helping ensure compliance across subscriptions and management groups.
Why It Doesn't Meet the Requirement
While Azure Policy evaluates and enforces compliance rules on resources, it is not the underlying management layer that receives API calls, orchestrates deployments, or handles resource lifecycle operations. Instead, Azure Resource Manager invokes Azure Policy as one step during the request validation workflow.
Key Characteristics and Limitations
- Evaluates resource properties and flags or prevents non-compliant resource deployments.
- Offers built-in and custom policy definitions to enforce configurations like allowed regions or required tags.
- Operates as a governance feature inside the control plane rather than the primary control plane gateway itself.
This Answer Would Be Correct If
A scenario required enforcing specific corporate rules, such as restricting deployment locations or blocking certain virtual machine sizes across an entire subscription.
Additional Context
Azure Policy integrates directly with Azure Resource Manager so that whenever a deployment request is submitted, ARM ensures the resource payload adheres to all active policy assignments.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
ARM Template Secure Parameters
Describe Azure Resource Manager (ARM) and ARM templates
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
ARM Template What-If Operation
Describe Azure Resource Manager (ARM) and ARM templates
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
ARM Template Condition Element
Describe Azure Resource Manager (ARM) and ARM templates
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
ARM Template Parameters Section
Describe Azure Resource Manager (ARM) and ARM templates
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Network Security Group
Describe the resources required for virtual machines
ExpertAZ-500 Microsoft Azure Security Technologies Exam
Application Permissions vs Delegated Permissions
Configure app registration permission scopes
Last updated Validated