AZ-104 Question 48
Single answerYour organization has multiple Azure subscriptions and wants to ensure a standard set of Azure Policy definitions is automatically enforced on all existing and future subscriptions. Which approach should you use?
- A
Assign an Azure Policy at each subscription individually to guarantee coverage everywhere.
- B
Set up a Microsoft Defender for Cloud policy to inherit Azure Policy definitions automatically.
- C
Use a preview feature in the Azure Portal to enable policy inheritance with a single click at the subscription level.
- D
Create a root-level management group and assign the necessary policy to that group for automatic inheritance.
Show answer and explanation
Correct answer: D
Explanation
Management groups enable centralized policy administration. By applying Azure Policies at the root-level management group, you ensure consistent policy enforcement across all present and future subscriptions in your organization.
- A. Incorrect.
Assigning policies individually at each subscription would work, but it would not automatically apply to any future subscriptions added to the environment.
- B. Incorrect.
Microsoft Defender for Cloud focuses on security recommendations and posture management, but it does not handle all aspects of subscription-wide policies automatically.
- C. Incorrect.
There is no single-click preview feature in the Portal that automatically inherits policies for all subscriptions. Policy inheritance has to be designed using management groups.
- D. Correct.
Assigning policies to a root-level management group automatically applies them to all subscriptions within that group and any future subscriptions added to it.