AZ-104 Question 54
Single answerYour organization wants to implement a single, top-level hierarchy for all Azure subscriptions by creating a new management group called 'ContosoRoot' to apply policies and user access. However, there is already a default Tenant Root Group at the highest level. Which action should you take to finalize your top-level management group configuration?
- A
Assign the 'ContosoRoot' management group as a child of the Tenant Root Group to inherit subscription policies.
- B
Rename the existing Tenant Root Group to 'ContosoRoot' and apply policies at this highest-level management group.
- C
Create a new parallel management group at the same level as the Tenant Root Group and move all subscriptions to it.
- D
Export the configuration of the Tenant Root Group and import it into your 'ContosoRoot' group for top-level governance.
Show answer and explanation
Correct answer: B
Explanation
In Azure, only the Tenant Root Group can serve as the top-level management group. If you want a custom name at the root, you must rename the existing Tenant Root Group. This ensures all subscriptions fall under a single, renamed root management group structure and maintain consistent governance and policy inheritance.
- A. Incorrect.
Making 'ContosoRoot' a child of the Tenant Root Group would not make it the top-level group for all subscriptions; it would inherit policies from the Tenant Root Group instead.
- B. Correct.
Only one top-level management group exists, which is the default Tenant Root Group. Renaming this group to 'ContosoRoot' ensures it remains at the highest level with your custom naming.
- C. Incorrect.
You cannot create a parallel top-level group alongside the Tenant Root Group; the Tenant Root Group always remains the single root in the hierarchy.
- D. Incorrect.
Exporting and importing configurations does not change the fundamental hierarchy structure at the root level; the Tenant Root Group must remain the single top-level group.