Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Govern Many Subscriptions with a Single Management Group
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise organization manages dozens of Azure subscriptions across several business units. The cloud governance team must enforce uniform security standards and grant administrative permissions across multiple subscriptions simultaneously, without having to configure role-based access control (RBAC) and governance rules on each subscription individually.
Which Azure architectural component should the team use to apply role assignments and policies across multiple subscriptions at once?
Explanations
Microsoft Entra security groups
Microsoft Entra security groups
What Microsoft Entra Security Groups Are
Microsoft Entra security groups (formerly Azure Active Directory security groups) are identity containers used to manage collections of user accounts, service principals, or managed identities for authentication and authorization purposes.
Why Microsoft Entra Security Groups Do Not Meet the Requirement
While a security group functions as the security principal in an Azure RBAC assignment, it is not an Azure resource container or architectural scope. A security group cannot hold subscriptions or provide an architectural boundary where policies and compliance rules are defined and inherited across subscriptions.
Key Characteristics and Limitations
- Identity Construct: Represents an identity object (the who) rather than an architectural governance target (the where).
- Requires Target Scope: Security groups must still be assigned to a scope—such as a management group, subscription, or resource group—to provide access.
- No Native Policy Enforcement: Security groups do not evaluate or enforce Azure Policy compliance across cloud infrastructure.
When This Option Would Be Correct
A Microsoft Entra security group is the correct choice when your goal is to bundle multiple user identities together so that permissions can be granted to the group rather than maintaining individual user assignments.
Management groups
Management groups
What Management Groups Are
Management groups are containers in the Azure resource hierarchy that sit above subscriptions. They provide a level of organization and governance that enables organizations to manage access, policies, and compliance across multiple subscriptions efficiently.
How Management Groups Meet the Requirements
When an administrator assigns an Azure role-based access control (Azure RBAC) role or an Azure Policy definition at the management group scope, all subscriptions, resource groups, and resources located within that management group automatically inherit those permissions and policies. This eliminates the operational overhead of manually creating role assignments and policy bindings across individual subscriptions.
Key Advantages and Capabilities
- Hierarchical Governance: Supports flexible nesting of up to six levels of depth to reflect organizational structures.
- Policy and RBAC Inheritance: Downward inheritance ensures that all child subscriptions adhere to corporate compliance and security rules automatically.
- Centralized Access Control: Allows security teams to grant broad read or administrative permissions to security principals (users, groups, or service principals) at scale.
- Unified Compliance Reporting: Aggregates compliance and policy assessment data across all encompassed subscriptions.
Why This Is Optimal
Using management groups is the recommended best practice in Azure architecture when governance and access must span across multiple subscriptions. It provides a single point of management that ensures consistency and eliminates configuration drift across enterprise workloads.
Resource groups
Resource groups
What Resource Groups Are
Resource groups are logical containers designed to hold, organize, and manage related Azure resources, such as virtual machines, storage accounts, and virtual networks.
Why Resource Groups Do Not Meet the Requirement
A resource group exists strictly within the boundary of a single Azure subscription. Because of this architectural limitation, a resource group cannot span across multiple subscriptions, nor can it be used as a parent container to manage subscriptions or enforce policies at a cross-subscription level.
Key Characteristics and Limitations
- Single Subscription Scope: Every resource group belongs to exactly one subscription and cannot contain other subscriptions.
- Lifecycle Boundary: Typically deployed to group resources that share the same lifecycle (e.g., created, updated, and deleted together).
- Downward-Only Inheritance: RBAC roles and policies applied at the resource group level only cascade down to the individual resources inside that specific resource group.
When This Option Would Be Correct
Resource groups are ideal when managing permissions and lifecycle operations for a specific application stack or project environment (e.g., development, staging, production) within a single subscription.
Managed identities
Managed identities
What Managed Identities Are
Managed identities provide an automatically managed identity in Microsoft Entra ID for cloud applications and resources (such as Azure Virtual Machines or Azure App Services) to authenticate securely against other Azure services supporting Entra authentication without embedding credentials in code.
Why Managed Identities Do Not Meet the Requirement
A managed identity acts as a service identity/principal and is not an organizational hierarchy component or container. It cannot contain subscriptions, host administrative structures, or enforce Azure Policy configurations across enterprise environments.
Key Characteristics and Limitations
- Credential Management: Eliminates the need for developers to manage secrets, certificates, or connection strings.
- Security Principal Role: Acts as the identity receiving permissions rather than the management container defining governance boundaries.
- Resource-Tied Lifecycle: System-assigned managed identities share their lifecycle directly with the single Azure resource they are enabled on.
When This Option Would Be Correct
Managed identities are the optimal solution when an application running on an Azure resource needs automated, secure, secretless authentication to services such as Azure Key Vault, Azure SQL Database, or Azure Storage.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Management Group ID vs Display Name
Describe management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Management Groups
Describe management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Hierarchy
Describe management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Management Groups
Describe management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model
Define cloud models, including public, private, and hybrid
IntermediateAZ-800 Administering Windows Server Hybrid Core Infrastructure Exam
Azure File Sync Event Logs and Azure Monitor
Configure and manage Azure File Sync
Last updated Validated