AZ-900 Practice Question 25: Management Groups
Microsoft Azure Fundamentals (AZ-900) · Test 3 · question 5 of 10
An enterprise holds 60 Azure subscriptions in one Microsoft Entra tenant. It wants a single policy limiting deployment regions, and a single role assignment for its security team, to reach every one of those subscriptions without being configured 60 times. What should it use?
Show answer and explanation
Answer:
Management groups exist for exactly this problem: they provide a governance scope above subscriptions, and the governance conditions you apply cascade by inheritance to every subscription under them. Microsoft's documented examples are a policy on a management group that limits the regions available for VM creation, and one Azure role assignment on a management group that inherits access to all the subscriptions beneath it, the two halves of this stem.
Option B inverts the hierarchy: a resource group sits *below* a subscription and holds resources, so it can never contain subscriptions. Option C confuses labelling with control; tags are metadata that help you identify and report on resources, and while a tag can be used as a *condition* inside a policy, a tag by itself assigns nothing and inherits nothing. Option D makes the problem worse: all subscriptions in a single management group must trust the same Microsoft Entra tenant, so splitting the estate into several tenants removes the possibility of one unified assignment.