Microsoft Certified: Azure Solutions Architect ExpertDesign identity, governance, and monitoring solutionsMedium
A large enterprise has several Azure subscriptions, each managed by different departments. The company needs to enforce a consistent naming convention for all resources, ensure specific resource tags are applied, and restrict resource deployments to approved Azure regions across all subscriptions. The solution must be centrally managed and applied hierarchically. Which Azure governance construct should be used to apply these policies effectively?
- ASubscription Policies
- BResource Groups
- CAzure Blueprints
- DManagement Groups
Show answer & explanationAnswer & explanation
Correct answer: D. Management Groups
Management Groups provide a level of scope above subscriptions, allowing you to organize subscriptions into containers and apply governance policies, such as Azure Policy assignments, to all subscriptions within that group. This enables central management and hierarchical application of policies across multiple subscriptions.
Why the other options are wrong
- A. Subscription Policies are applied only to a single subscription and do not provide cross-subscription or hierarchical governance.
- B. Resource Groups are for organizing resources within a single subscription and do not provide cross-subscription governance.
- C. Azure Blueprints deploy and update entire environments, including policies, but Management Groups are the direct construct for applying policies hierarchically across subscriptions.
Azure Management Groups
A container for subscriptions that allows you to apply governance policies and access controls across multiple subscriptions simultaneously. They provide a level of organization above the subscription level.
- Hierarchical structure for organizing subscriptions
- Inherit policies and RBAC assignments from parent groups
- Essential for large-scale governance
Memory trick: MANAGEMENT Groups are the 'ORG Chart' for subscriptions.