AZ-305 Question 41
Single answerYou are designing an Azure governance model for an international organization that manages multiple Azure subscriptions. The leadership team requires consistent policies across all subscriptions, including standardized resource naming, tagging, and location restrictions. They want to manage these rules centrally so that new subscriptions and existing ones automatically inherit the same configurations and remain compliant. Which governance approach should you implement to achieve these requirements?
- A
Create resource locks at each subscription level to restrict unauthorized changes
- B
Use Azure Policy assignments at the management group level
- C
Use Azure Blueprints individually in each subscription to deploy naming and tagging rules
- D
Leverage ARM templates at each resource group level to apply tags and location constraints
Show answer and explanation
Correct answer: B
Explanation
Azure Policy, assigned at the management group level, provides a scalable way to enforce compliance across multiple subscriptions. By assigning policies at a management group, all subscriptions under that group inherit the same governance rules automatically. This aligns with Microsoft documentation on Azure governance best practices, which recommends management groups and Azure Policy for consistent, centralized governance of resource deployments and configurations.
- A. Incorrect.
Option 1: Creating resource locks at each subscription level only prevents certain modifications (deleting or modifying locked resources), but it does not provide a way to enforce or standardize naming, tagging, or location. Resource locks are more about preventing accidental deletes or changes rather than applying broad governance rules.
- B. Correct.
Option 2: Using Azure Policy at the management group level is correct because it allows you to apply policies that automatically propagate to all subscriptions under that management group. This ensures consistent rules for resource naming, tagging, and location, meeting the requirement to centrally manage these standards.
- C. Incorrect.
Option 3: Azure Blueprints can bundle policies, role assignments, and other artifacts for consistent deployment, but using them individually in each subscription would require more overhead to maintain and update. It does not centralize the enforcement as effectively as a management group assignment for policies.
- D. Incorrect.
Option 4: ARM templates can be used to deploy resources with predefined tags or constraints, but they do not continuously enforce policies. They only apply configuration at deployment time. This does not provide a mechanism to ensure ongoing compliance across all subscriptions.