AZ104-Q: Applying policy & RBAC to many subscriptions
Q: You manage subscriptions that report to several business units and must apply the same Azure Policy and the same RBAC role assignment so that future subscriptions also inherit them. What is the most efficient way?
- A) Place all subscriptions under a management group and assign the policy and role at that group ✓
- B) Assign the policy and role to each subscription one by one
- C) Assign them to a single resource group
- D) Use Conditional Access to enforce the role
Answer: A — Management groups. Management groups organize subscriptions into a hierarchy; Azure Policy definitions and RBAC role assignments applied at a management group inherit down to every subscription and resource beneath it — including subscriptions added later. Assigning per-subscription (B) is repetitive and misses new subscriptions; a resource group (C) does not scale to the subscription level. Conditional Access (D) controls authentication, not roles.
Why it helps
Management groups are the governance container above subscriptions. Remember: policy + RBAC assigned at a management group inherit to all child subscriptions.