Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Azure Subscription as Billing and Access Boundary
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is deploying new workloads in Azure and needs to establish a management boundary for several development teams.
The organization has the following requirements:
- Group multiple resource groups together under a single billing unit to generate isolated invoices.
- Apply security access permissions (Azure RBAC) and compliance rules (Azure Policy) that automatically inherit down to all contained resource groups.
- Maintain a trust relationship with the organization's Microsoft Entra tenant for user authentication.
Which Azure architectural component meets these requirements?
Explanations
Microsoft Entra tenant
Microsoft Entra tenant
What a Microsoft Entra Tenant Is
A Microsoft Entra tenant (formerly Azure Active Directory) is a dedicated, cloud-based identity and access management service instance that represents an organization, hosting user accounts, security groups, and application registrations.
Why It Doesn't Meet the Requirement
- Identity Scope, Not Resource Hierarchy: A Microsoft Entra tenant is an identity directory rather than an Azure infrastructure management container that organizes resource groups.
- Not an Azure Billing Invoice Boundary: Cloud resource consumption costs are billed through Azure subscriptions rather than the identity directory itself.
- Does Not Contain Resource Groups: Resource groups reside within Azure subscriptions, not directly within the Entra ID tenant structure.
Key Characteristics and Limitations
- Authentication and Identity: Provides identity verification, single sign-on (SSO), and conditional access.
- One-to-Many Relationship: A single Microsoft Entra tenant can be trusted by multiple Azure subscriptions simultaneously.
- Directory-Level Roles: Governs identity administration (such as Global Administrator) rather than direct Azure infrastructure resource deployments.
This Answer Would Be Correct If
The requirement focused strictly on authenticating users, synchronizing on-premises user accounts to the cloud, or managing identity lifecycles and federation.
Additional Context
Although Azure subscriptions rely on a Microsoft Entra tenant for authenticating security principals, the tenant itself is not the container used to group resource groups or track infrastructure billing charges.
Azure subscription
Azure subscription
What an Azure Subscription Is
An Azure subscription is a logical container and foundational building block in Azure that links user accounts to the cloud resources they provision. It functions as both a primary billing boundary and an administrative access and governance boundary within the Azure resource hierarchy.
How It Meets the Requirements
- Billing Boundary: Each Azure subscription generates its own separate billing reports and invoices, allowing organizations to separate and track costs across departments, environments, or projects.
- Resource Group Container: A single subscription holds multiple resource groups, providing a parent scope where policies and access permissions can be applied uniformly.
- Inherited Governance and Access: Assigning Azure role-based access control (Azure RBAC) roles and Azure Policy definitions at the subscription scope ensures that all child resource groups and resources automatically inherit these permissions and compliance controls.
- Identity Integration: Every subscription has an established trust relationship with a single Microsoft Entra tenant (directory) to handle identity authentication and authorization for administrators and service principals.
Key Advantages and Capabilities
- Cost segregation: Enables precise chargeback and showback by generating isolated invoices per subscription.
- Scalable administration: Simplifies permission management by applying role assignments at a single scope above multiple resource groups.
- Enforced compliance: Audits and restricts configuration settings across all contained resources using centralized policy assignments.
- Defined resource quotas: Enforces specific scale limits and service quotas independently per subscription.
Why This Is Optimal
An Azure subscription sits directly above resource groups in the management hierarchy, making it the exact architectural unit designed to aggregate resource groups, isolate billing invoices, and cascade access controls downward.
Azure resource group
Azure resource group
What an Azure Resource Group Is
An Azure resource group is a fundamental logical container used to deploy, manage, and organize related Azure resources such as virtual machines, virtual networks, and databases that share a common lifecycle.
Why It Doesn't Meet the Requirement
- Cannot Nest Other Resource Groups: A resource group cannot contain other resource groups; it only contains individual Azure resources.
- Not an Independent Billing Unit: Resource groups do not receive their own isolated invoices by default. Costs incurred by resources inside a resource group are rolled up and billed to the parent Azure subscription.
- Limited Scope of Inheritance: Access policies assigned at the resource group scope only apply to the resources within that specific group, failing the requirement to govern multiple resource groups from a single boundary.
Key Characteristics and Limitations
- Single Subscription Membership: Each resource group belongs exclusively to one subscription.
- Lifecycle Boundary: Deleting a resource group automatically deletes all contained resources simultaneously.
- Resource Group Scope: RBAC roles and policies applied here do not affect sibling resource groups.
This Answer Would Be Correct If
A scenario required grouping individual cloud services that share the same lifecycle, deployment schedule, or administrative permissions into a single management unit.
Additional Context
Resource groups exist inside subscriptions. While essential for organizing applications, they depend entirely on their parent subscription for identity association, billing generation, and subscription-level quota allocations.
Azure management group
Azure management group
What an Azure Management Group Is
An Azure management group is a governance container positioned above subscriptions in the Azure management hierarchy, designed to manage access, policies, and compliance across multiple subscriptions simultaneously.
Why It Doesn't Meet the Requirement
- Not a Primary Billing Unit: Management groups do not generate separate invoices or act as the direct billing boundary for service consumption; actual usage billing and payment processing occur at the Azure subscription level.
- Direct Parent to Subscriptions, Not Resource Groups: Management groups organize subscriptions and other child management groups rather than containing resource groups directly.
- Broader Scope Than Needed: While management groups cascade policies to subscriptions, they do not serve as the fundamental unit that directly hosts resource groups.
Key Characteristics and Limitations
- Subscription Aggregation: Designed specifically to manage multi-subscription governance architectures.
- Hierarchical Depth: Supports nested structures up to six levels of depth for enterprise-wide policy alignment.
- No Direct Resource Placement: Azure resources and resource groups cannot be deployed directly inside a management group.
This Answer Would Be Correct If
The organization required centralized governance, compliance enforcement, and role assignments across dozens of different Azure subscriptions.
Additional Context
Management groups sit at the top of the Azure resource hierarchy above subscriptions, providing overarching governance rather than functioning as the transactional billing and workload hosting layer.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Hierarchy
Describe the hierarchy of resource groups, subscriptions, and management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Management Groups
Describe the hierarchy of resource groups, subscriptions, and management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Group
Describe the hierarchy of resource groups, subscriptions, and management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Management Group Policy and RBAC Inheritance
Describe the hierarchy of resource groups, subscriptions, and management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
ARM Template Parameters Section
Describe Azure Resource Manager (ARM) and ARM templates
ExpertAZ-305 Designing Microsoft Azure Infrastructure Solutions Exam
Azure Container Apps vs AKS
Recommend a container-based solution
Last updated Validated