Subscriptions and management groups in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Azure Management Groups Hierarchy

In Azure, you want to organize multiple subscriptions under a management group hierarchy. Which statement correctly describes the relationship between management groups and subscriptions?

A A management group can contain multiple subscriptions and other management groups, forming a tree structure.

B A subscription can belong to multiple management groups at the same time.

C Subscriptions are always at the top level and cannot be nested under management groups.

D Management groups are only used for billing and cannot contain subscriptions.

💡 Hint

Think about how Azure organizes resources for governance and policy application.

Management groups form a hierarchy where each management group can contain subscriptions and other management groups, allowing centralized management.

❓ Architecture

intermediate

Designing Subscription Structure for Cost Management

You manage an organization with multiple departments. You want to separate billing and policies per department but keep centralized control. Which Azure structure best supports this?

A Create multiple management groups per department but use a single subscription for all.

B Create one subscription for all departments and use resource groups to separate resources.

C Use a single management group with no subscriptions and manage resources directly under it.

D Create separate subscriptions per department and place them under a single management group for centralized policy management.

💡 Hint

Consider how billing and policy boundaries work in Azure.

Separate subscriptions per department allow distinct billing and resource limits, while management groups enable centralized policy and access control.

❓ security

advanced

Applying Policies Across Multiple Subscriptions

You want to enforce a security policy that restricts VM sizes across all subscriptions in your organization. Where should you assign this policy for the most efficient management?

A Assign the policy individually to each subscription.

B Assign the policy at the management group that contains all subscriptions.

C Assign the policy at the resource group level inside each subscription.

D Assign the policy at the tenant root level only.

💡 Hint

Think about applying policies once to affect many subscriptions.

Assigning the policy at the management group level applies it to all subscriptions under it, simplifying management and ensuring consistency.

❓ service_behavior

advanced

Effect of Moving a Subscription Between Management Groups

You move a subscription from one management group to another. What immediate effect does this have on the subscription's policy and access control?

A The subscription inherits policies and access controls from the new management group immediately, replacing previous ones.

B The subscription retains all previous policies and access controls permanently.

C The subscription loses all policies and access controls until manually reassigned.

D The subscription duplicates policies from both old and new management groups, causing conflicts.

💡 Hint

Consider how inheritance works in Azure management groups.

When a subscription moves, it inherits policies and access controls from the new management group, which override previous ones.

✅ Best Practice

expert

Optimizing Management Group Structure for Large Enterprises

Your enterprise has hundreds of subscriptions across multiple regions and business units. What is the best practice for structuring management groups to balance governance, scalability, and ease of management?

A Create a flat structure with all subscriptions directly under the root management group to simplify hierarchy.

B Avoid using management groups and manage policies at the subscription level for maximum flexibility.

C Create a balanced hierarchy grouping subscriptions by business unit first, then by region, limiting nesting depth to maintain clarity.

D Create a deep hierarchy with many nested management groups per business unit and region to isolate policies strictly.

💡 Hint

Think about balancing complexity and manageability in large organizations.

A balanced hierarchy grouping by business unit and region with limited nesting helps maintain clarity, scalability, and effective governance.

Practice

1. What is the main purpose of an Azure subscription?

easy

A. To group cloud resources for billing and access control

B. To organize management groups in a hierarchy

C. To apply policies across multiple tenants

D. To create virtual networks automatically

Solution

1. Step 1: Understand the role of subscriptions

   Subscriptions in Azure are containers that group resources for billing and access control.

2. Step 2: Differentiate from management groups

   Management groups organize subscriptions, not the other way around.

3. Final Answer:

   To group cloud resources for billing and access control -> Option A

4. Quick Check:

   Subscription = billing and access grouping [OK]

Hint: Subscriptions group resources for billing and access [OK]

Common Mistakes:

• Confusing subscriptions with management groups
• Thinking subscriptions organize management groups
• Assuming subscriptions apply policies directly

2. Which of the following is the correct way to create a management group using Azure CLI?

easy

A. az mg create --name MyGroup

B. az management-group create --group-name MyGroup

C. az account management-group create --name MyGroup

D. az group create --management MyGroup

Solution

1. Step 1: Identify the correct Azure CLI command

   The command to create a management group is 'az account management-group create' with the --name parameter.

2. Step 2: Check the options for syntax correctness

   az account management-group create --name MyGroup matches the correct syntax; others use incorrect commands or parameters.

3. Final Answer:

   az account management-group create --name MyGroup -> Option C

4. Quick Check:

   Correct CLI command = az account management-group create --name MyGroup [OK]

Hint: Use 'az account management-group create' to create groups [OK]

Common Mistakes:

• Using 'az group create' which creates resource groups, not management groups
• Incorrect parameter names like --group-name
• Shortened commands like 'az mg create' which don't exist

3. Given the following hierarchy: Management Group A contains Subscription X and Subscription Y. A policy is assigned at Management Group A. What is the effect on Subscription X and Y?

medium

A. Only Subscription X is affected by the policy

B. Both Subscription X and Y inherit the policy

C. Only Subscription Y is affected by the policy

D. Neither subscription is affected by the policy

Solution

1. Step 1: Understand policy inheritance in management groups

   Policies assigned at a management group apply to all child subscriptions automatically.

2. Step 2: Apply this to the given hierarchy

   Since both Subscription X and Y are under Management Group A, both inherit the policy.

3. Final Answer:

   Both Subscription X and Y inherit the policy -> Option B

4. Quick Check:

   Management group policies apply to all child subscriptions [OK]

Hint: Policies at management group apply to all child subscriptions [OK]

Common Mistakes:

• Thinking policies apply only to one subscription
• Assuming subscriptions override management group policies
• Believing policies do not inherit down the hierarchy

4. You tried to assign a subscription to a management group but received an error. Which of the following is a likely cause?

medium

A. Subscriptions can only be assigned via Azure Portal, not CLI

B. Management groups cannot contain subscriptions

C. You must create a resource group before assigning subscriptions

D. The subscription is already assigned to another management group

Solution

1. Step 1: Recall subscription assignment rules

   Each subscription can belong to only one management group at a time.

2. Step 2: Analyze the error cause

   If the subscription is already assigned elsewhere, reassigning without removal causes an error.

3. Final Answer:

   The subscription is already assigned to another management group -> Option D

4. Quick Check:

   One subscription per management group at a time [OK]

Hint: Check if subscription is already assigned before reassigning [OK]

Common Mistakes:

• Thinking management groups cannot contain subscriptions
• Believing resource groups are needed before assignment
• Assuming CLI cannot assign subscriptions

5. You have three subscriptions: S1, S2, and S3. You want to apply a security policy to S1 and S2 but not S3. How can you organize management groups to achieve this?

hard

A. Create a management group with S1 and S2 as children, assign the policy there; leave S3 outside

B. Assign the policy directly to S1 and S2 subscriptions individually

C. Put all three subscriptions in one management group and exclude S3 from the policy assignment

D. Create separate management groups for each subscription and assign the policy to S1 and S2 groups

Solution

1. Step 1: Understand management group hierarchy for policy scope

   Policies assigned to a management group apply to all its child subscriptions.

2. Step 2: Organize subscriptions to control policy application

   By placing S1 and S2 in a management group and assigning the policy there, S3 remains unaffected if outside that group.

3. Final Answer:

   Create a management group with S1 and S2 as children, assign the policy there; leave S3 outside -> Option A

4. Quick Check:

   Group subscriptions to control policy scope [OK]

Hint: Group only targeted subscriptions to apply policies selectively [OK]

Common Mistakes:

• Assigning policy to all subscriptions and trying to exclude one
• Assigning policies individually instead of using groups
• Putting all subscriptions in one group and expecting selective policy