AZ-305 Question 47
Single answerContoso has multiple lines of business, each requiring separate dev, test, and production environments, and wants to centralize governance for cost analysis, security policies, and organizational alignment. You have been asked to recommend a structure for management groups, subscriptions, and resource groups, as well as a tagging strategy to consistently identify ownership and cost centers. Which approach best fulfills these requirements while minimizing administrative overhead?
- A
Create a single subscription for all resources and rely on manual naming conventions instead of tagging. Place all resources directly under the tenant root management group and assign them to different resource groups based on environment.
- B
Establish separate root-level management groups for each line of business. Assign each environment (dev, test, production) as a resource group under a single subscription, and require owners to update tags manually.
- C
Use one root management group, create child management groups for each environment (e.g., Dev, Test, Prod), and assign subscriptions to each relevant management group. Then structure resource groups according to workloads or applications and enforce tags (like cost center, owner, etc.) via Azure Policy.
- D
Create a different root management group for each environment, and place all subsequent subscriptions under those groups. Then only assign tags at the resource group level, relying on user adoption to keep them updated.
Show answer and explanation
Correct answer: C
Explanation
Microsoft recommends establishing a manageable hierarchy starting with a single root management group, then creating child management groups, typically aligned by environment or department. Subscriptions are assigned to child management groups so that governance policies (including mandatory tags) can be inherited. Resource groups are then structured to group related workloads. Azure Policy can enforce tagging standards across all resources. For further details, refer to the official Azure documentation on Management Groups and Tagging Best Practices.
- A. Incorrect.
Incorrect. A single subscription often limits scalability and makes cost management more complex. Relying on manual naming conventions without mandatory tagging can lead to inconsistent or incomplete metadata.
- B. Incorrect.
Incorrect. Splitting root-level management groups per line of business can create fragmentation and management overhead. Additionally, placing dev, test, and production as resource groups within a single subscription doesn’t provide the desired governance separation or cost tracking consistency.
- C. Correct.
Correct. Using a single root management group with environment-centric child management groups is a recommended best practice. Assigning subscriptions at the management group level allows you to apply policies consistently. Enforcing tags via Azure Policy helps ensure consistent and automated application of critical tags (e.g., cost center, owner).
- D. Incorrect.
Incorrect. Creating multiple root management groups, each for a different environment, can overcomplicate your hierarchy. Also, depending solely on user adoption for tagging at the resource group level can lead to inconsistent data. Central enforcement through Azure Policy is more effective.