AZ-900 Practice Question 64: Policy Inherits New Resource Group
Microsoft Azure Fundamentals (AZ-900) · Test 7 · question 4 of 10
A subscription administrator assigns an Azure Policy definition that denies the creation of public IP addresses, scoping the assignment to the subscription itself. Six months later, a new resource group is created under that subscription, and no one assigns any policy directly to it. What happens when someone tries to deploy a public IP address inside the new resource group?
Show answer and explanation
Answer:
Azure Resource Manager defines four levels of management scope (management groups, subscriptions, resource groups, and resources), and lower levels inherit settings from higher levels. Microsoft's own example is this exact scenario: "when you apply a policy to the subscription, the policy is applied to all resource groups and resources in your subscription." That inheritance is automatic and applies to resource groups created at any time, including ones that didn't exist yet when the assignment was made.
Options A and C both invent a manual step (reassigning the policy to each new resource group) that inheritance makes unnecessary; nothing needs to be repeated or reapplied. Option B directly contradicts how scope inheritance works: a subscription-scoped assignment is defined to reach everything nested beneath it, not only the exact scope where it was created.
Reference: What is Azure Resource Manager?