AZ-104 Question 33
Single answerYou are an Azure Administrator for a global retail organization that manages multiple Azure subscriptions. The organization wants to enforce a security baseline across all existing and future subscriptions, including restricting specific resource types and requiring tags for cost management. You have already created a custom Azure Policy initiative that contains these requirements. Where should you assign this initiative so that it applies to every subscription in your environment, including those that will be created in the future?
- A
Assign the initiative manually in each subscription to ensure coverage
- B
Assign the initiative at the resource group level in each subscription
- C
Assign the initiative at the management group that contains all subscriptions
- D
Assign the initiative at the tenant root group to cover the entire Azure AD tenant
Show answer and explanation
Correct answer: C
Explanation
Azure Management Groups provide a hierarchical structure above subscriptions to manage policies and RBAC across multiple subscriptions. By assigning the initiative at the management group level, you ensure that any subscription within that group automatically inherits and applies the required policies.
- A. Incorrect.
Assigning the initiative manually in each subscription requires repetitive effort and can be prone to errors or omissions if new subscriptions are created.
- B. Incorrect.
Assigning at the resource group level still requires per-subscription configuration. It also doesn’t cover new resource groups or make subscription-wide enforcement uniform by default.
- C. Correct.
Assigning policies or initiatives at the management group level ensures consistent governance across all current and future subscriptions under that management group.
- D. Incorrect.
While assigning initiatives at the tenant root group can enforce policies broadly, it may include subscriptions or areas of the tenant that don’t require these specific constraints, potentially causing unnecessary restrictions.