Minimum Management Groups for Finance and IT Policies?
Your company has IT, security, and finance departments. You need to implement a new Azure deployment that will include multiple Azure subscriptions and management groups. The solution must meet the following requirements: • Ensure that all policies are assigned at the management group level. • Ensure that all the finance department resources have specific encryption policies applied. • Ensure that only users in the IT department can create virtual machines in any Azure region. • Ensure that users in the finance department can create virtual machines in only the East US Azure region. What is the minimum number of management groups you can create for the planned deployment?
Community Insight
The question tests whether you can reduce department requirements to the fewest distinct policy scopes; the trap is assuming every department named in the scenario needs its own management group.
Azure management groups define the policy and RBAC inheritance boundary for subscriptions. This deployment needs two management groups: one finance scope for encryption and East US VM restrictions, and one shared IT/security scope.
Many candidates choose three or four by creating one management group per department, but security has no unique policy requirement and finance can hold both encryption and East US location policies in one group.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Two management groups satisfy the requirements because management groups are policy-inheritance containers, not one-per-department labels. Create a Finance management group, assign the encryption policies plus an allowed-locations policy limited to East US for virtual machines, and place all finance subscriptions beneath it. Create a second management group for the remaining subscriptions; grant the IT department the VM Contributor role there so IT users can create VMs in any region, and do not grant that role to security users. RBAC controls who can create VMs, while Azure Policy enforces the finance-specific encryption and region constraints; both can be scoped at the management-group level. AllanHouston's comment captures the key point: "Multiple policies can be assigned to the same management group."Why the Other Options Are Wrong
A single management group cannot apply the East US VM restriction only to finance while leaving IT unrestricted, because a policy assigned at that shared scope would inherit to every subscription. Three groups is unnecessary unless security had a separate policy set; the scenario only requires that security users not receive VM creation rights, which is an RBAC omission or deny assignment, not a dedicated policy scope. Four groups overcounts further by treating each department or subscription type as a separate policy boundary. The minimum is driven by distinct policy requirements: finance versus non-finance.Community Comment Notes
AllanHouston's answer of B matches the two-scope design: finance gets both encryption and East US VM policies in one group, while IT gets a separate management group for unrestricted-region VM creation. The comment also correctly notes that "Multiple policies can be assigned to the same management group," which is why finance does not need separate groups for encryption and location. No other community detail changes the analysis.Official Reference
Exam Strategy
Count distinct policy and RBAC scopes, not departments. If two departments can share the same effective policy set, place them in one management group; split only when a requirement must apply to one group and not the other.
Frequently Asked Questions
Why can finance encryption and East US VM policies share one management group?
Azure Policy supports multiple assignments at the same management-group scope; both policies inherit to every finance subscription without needing separate groups.
Why is a separate management group for the security department not required?
Security has no unique policy set in the requirements; omitting VM Contributor or applying a deny assignment to security users in the shared IT/security group enforces the restriction.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →