Microsoft Certified: DevOps Engineer ExpertDevelop a security and compliance planMedium
A DevOps team is responsible for managing multiple Azure subscriptions, each belonging to a different business unit. Each business unit has specific cost management and resource tagging requirements. The team needs a hierarchical structure to apply these governance policies consistently across all subscriptions and to delegate administrative responsibilities effectively. Which Azure feature should they implement?
- AAzure Lighthouse
- BAzure Blueprints
- CResource Groups
- DManagement Groups
Show answer & explanationAnswer & explanation
Correct answer: D. Management Groups
Management Groups provide a hierarchical structure that allows you to organize subscriptions into groups and apply governance policies, such as Azure Policy and Azure RBAC, to all subscriptions within that group. This is ideal for managing multiple subscriptions with consistent policies and delegated administration.
Why the other options are wrong
- A. Azure Lighthouse enables service providers to manage Azure resources for multiple customers from their own tenant, which is not the primary use case here for internal enterprise governance.
- B. Azure Blueprints define a repeatable set of Azure resources and policies, but Management Groups provide the hierarchical organization for assigning these blueprints across multi-subscription environments.
- C. Resource Groups are containers for resources within a single subscription and do not provide a hierarchical structure across multiple subscriptions.
Azure Management Groups
A service that provides a hierarchical structure above subscriptions, allowing for centralized management of access, policies, and compliance across multiple subscriptions.
- Supports up to six levels of hierarchy (excluding the root group).
- Policies and RBAC assignments inherit down the hierarchy.
- Enables consistent governance across an enterprise's Azure estate.
Memory trick: Manage your Azure kingdom with a clear, Grouped hierarchy!