AZ-104 Practice Question 20: Management Group Tenant Boundary
Microsoft Azure Administrator Associate (AZ-104) · Test 2 · question 10 of 10
Contoso has acquired Fabrikam. Contoso's governance policies are assigned to the management group mg-corp in the Contoso Microsoft Entra tenant. Fabrikam's five Azure subscriptions live in Fabrikam's own separate Entra tenant.
You are asked to bring those five subscriptions under mg-corp so that they inherit Contoso's policy assignments. What must happen first?
Show answer and explanation
Answer:
The management group hierarchy is scoped to one directory: "all subscriptions within a single management group must trust the same Microsoft Entra tenant," and "all subscriptions and management groups are within a single hierarchy in each directory." A subscription therefore has to be moved into the Contoso tenant before it can sit anywhere in Contoso's hierarchy and inherit mg-corp's policy assignments. Expect to re-create role assignments afterwards; they do not survive a directory transfer, because the principals they referenced belong to the old tenant.
Option A is impossible. "Each directory has a single top-level management group called the *root* management group," created automatically, and every management group and subscription folds up into it. There is no second root to create.
Option B grants people access; it does not move subscriptions. Guest accounts with Owner on mg-corp can administer resources under Contoso's hierarchy, but Fabrikam's subscriptions remain in the other tenant and inherit nothing from mg-corp.
Option D fails twice. "The root management group can't be moved or deleted, unlike other management groups," and a management group cannot be re-parented across directories in any case.
Reference: Organize your resources with Azure management groups