An enterprise wants Azure Policy and RBAC assignments to inherit automatically to dozens of subscriptions organized by department. What should they use above the subscription level?
A.Resource groups
Resource groups are below subscriptions — they can't span subscriptions.
B.Management groups
Management groups = the governance layer above subscriptions. Correct.
C.Availability sets
Availability sets are a VM fault-domain construct, not an organizational hierarchy.
D.Tags
Tags label resources for cost/reporting — they don't inherit policy or access.
Why this answer
Management groups sit above subscriptions in the hierarchy (tenant root → management groups → subscriptions → resource groups → resources). Policy and access assigned at a management group inherit to all child subscriptions — the standard mechanism for at-scale governance.
Correct answer: B · Last reviewed 2026-02-13
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Core Azure Services practice session.
Practice Core Azure Services