Microsoft Certified: Azure Solutions Architect ExpertDesign identity, governance, and monitoring solutionsEasy
A large enterprise has several Azure subscriptions, each managed by different departments. The IT governance team needs to enforce a consistent set of compliance policies across all subscriptions, such as mandatory tagging for resources and restricting resource deployments to specific Azure regions. They also need to delegate policy management to departmental IT teams but retain an overarching control. Which Azure governance construct should be used?
- AManagement Groups
- BResource Groups
- CAzure Policy Assignments
- DCustom RBAC Roles
Show answer & explanationAnswer & explanation
Correct answer: A. Management Groups
Management Groups allow you to organize subscriptions into hierarchical containers. Policies and RBAC roles assigned at a Management Group level inherit down to all subscriptions and resource groups within that hierarchy, providing consistent governance and enabling delegation while maintaining central control.
Why the other options are wrong
- B. Resource Groups are for organizing resources within a single subscription and do not provide a way to enforce policies across multiple subscriptions.
- C. Azure Policy Assignments are the *mechanism* for applying policies, but Management Groups are the *scope* that enables consistent application across multiple subscriptions and delegation.
- D. Custom RBAC Roles define permissions but don't provide the hierarchical organization needed to enforce policies consistently across multiple subscriptions or delegate policy management at a higher level.
Azure Management Groups
Azure Management Groups are containers that help you manage access, policy, and compliance across multiple Azure subscriptions. They provide a level of organization above subscriptions.
- Hierarchical structure for organizing subscriptions
- Policies and RBAC roles inherit down the hierarchy
- Enables consistent governance across the enterprise
- Supports up to six levels of depth
Memory trick: Management Groups Manage Many Subscriptions.