AZ-104 Question 47
Single answerYour organization manages multiple Azure subscriptions for different departments. You need to ensure that a consistent set of policies and role assignments is applied across both existing and future subscriptions, minimizing administrative overhead and maintaining unified governance. Which approach should you implement?
- A
Consolidate all resources into a single subscription and apply policies at the subscription level
- B
Assign subscription-level roles and policies manually for each new subscription
- C
Use resource locks on each subscription's resource groups to enforce governance
- D
Create a management group hierarchy and apply Azure policies at the management group level
Show answer and explanation
Correct answer: D
Explanation
Management groups allow you to define and apply Azure policies and role assignments at a higher level. Every subscription added under a management group automatically inherits these settings, ensuring a scalable approach to unified governance across your organization’s Azure environment.
- A. Incorrect.
While placing all resources in one subscription can unify policy application, this approach is not scalable and increases the risk of resource management conflicts across different departments.
- B. Incorrect.
Manually assigning roles and policies for each new subscription is time-consuming and prone to misconfiguration or oversight, especially as your environment grows.
- C. Incorrect.
Resource locks help protect resources from accidental modification or deletion but do not offer a centralized method for applying compliance and governance policies across subscriptions.
- D. Correct.
By creating a management group hierarchy, you can automatically inherit Azure policies and role assignments in all underlying subscriptions, ensuring consistency and reducing administrative effort.