AZ-900 Practice Question 68: MCA Billing Scopes
Microsoft Azure Fundamentals (AZ-900) · Test 7 · question 8 of 10
A company has a single Microsoft Customer Agreement billing account. Finance wants one role that can view and manage invoices and payment methods for the entire organization. Separately, each engineering team should be able to create Azure subscriptions billed to its own department, without seeing any other department's costs. Which scopes should the two roles be assigned at, respectively?
Show answer and explanation
Answer:
"Roles on the billing account have the highest level of permissions" and are meant for users who "need to view invoices, and track costs for your entire organization", exactly finance's need. Underneath a billing profile, "roles on the invoice section have permissions to control who creates Azure subscriptions" that are billed to that section, and a single billing profile can hold one invoice section per project, department, or environment, each isolated from the others, exactly what the engineering teams need.
Option B is wrong on both halves: a billing profile role is scoped below the billing account, so it doesn't reach "the entire organization" if more than one profile exists, and a management group is a governance scope for policy and RBAC, not a billing scope; it grants no ability to create subscriptions billed anywhere. Option C is wrong because a resource group is a container for resources inside a subscription; it sits outside the billing hierarchy entirely and has no role that controls subscription creation. Option D swaps the two roles: an invoice-section role is too narrow for finance's organization-wide requirement, and a billing-account role for engineering would let every department see every other department's costs, defeating the isolation the scenario asks for.
Reference: Get started with a Microsoft Customer Agreement billing account