Azure Resource Segmentation Strategy

AZ-900 By islever Editorial Last updated

Describe features and tools in Azure for governance and compliance

Short answer

B The solution does not meet the goal because using multiple Azure AD directories increases administrative complexity instead of minimizing it.

Question

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if
the solution satisfies the requirements.
You are planning to migrate a company to Azure. Each of the company's numerous divisions will have an administrator in place to manage the Azure resources
used by their respective division.
You want to make sure that the Azure deployment you employ allows for Azure to be segmented for the divisions, while keeping administrative effort to a
minimum.
Solution: You plan to make use of several Azure Active Directory (Azure AD) directories.
Does the solution meet the goal?
  1. Yes
  2. No Correct Answer

Key Takeaways

The core trap is confusing identity isolation with resource governance; using multiple tenants increases complexity rather than simplifying management.

This question evaluates the correct approach for segmenting Azure resources across multiple divisions while minimizing administrative overhead. The page clarifies why using multiple Azure AD directories fails to meet efficiency goals.

Common mistake: Learners often select 'Yes' assuming that separate directories provide better security or segmentation, ignoring the explicit requirement to minimize administrative effort.

Expert Analysis

Why the Answer Is Correct

The solution does not meet the goal because creating multiple Azure Active Directory (Azure AD) directories results in separate, isolated tenants. This architecture significantly increases administrative effort due to the need to manage distinct identities, policies, and settings for each directory, violating the requirement to keep effort minimal. Instead, a single Azure AD tenant should be used, leveraging Management Groups, Subscriptions, and Role-Based Access Control (RBAC) to segment resources efficiently.

Why the Other Options Are Wrong

Option A ('Yes') is incorrect because it assumes segmentation equals isolation. While multiple directories do isolate data, they create silos that make cross-divisional collaboration and centralized administration difficult and costly. The prompt explicitly demands minimum administrative effort, which multi-tenant setups cannot provide.

Community Comment Notes

Community consensus strongly supports Option B. As Georgess noted, the keyword 'SEVERAL' implies unnecessary complexity compared to organizing within a single directory. Other users like Meesquared highlighted that multiple directories prevent easy sharing of users and resources, leading to duplicated efforts. Comments from dgk and mmmmmnm correctly point out that Management Groups are the appropriate tool for this hierarchy, analogous to AWS Organizations.

Exam Strategy

Always prioritize the constraint 'minimize administrative effort' when choosing between architectural options. In Azure, prefer hierarchical governance tools (Management Groups/Subscriptions) over identity isolation (multiple tenants) for internal organizational segmentation.

Frequently Asked Questions

Why can't I use multiple Azure AD directories for segmentation?

Multiple directories create isolated tenants, requiring separate management of users, groups, and policies, which increases administrative effort rather than reducing it.

What is the best way to segment resources for different divisions?

Use a single Azure AD tenant with Management Groups and Subscriptions to enforce hierarchy and RBAC permissions, allowing centralized management with granular access control.

More AZ-900 FAQ →

Discussion 37 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 37

  1. Georgess 👍 171
    The proposed solution is: You plan to make use of several Azure Active Directory (Azure AD) directories. I think the key word is SEVERAL. Why in the world a company will create SEVERAL AADs when it can create a single AAD and organize its divisions right there? This is why I consider the correct answer B (No).
  2. BeauChateau 👍 45 Answered B
    No, the solution does not meet the goal. Using multiple Azure Active Directory (Azure AD) directories to segment Azure resources for each division may not be the most efficient way to manage the resources. While it does provide segregation of resources and administrative control, it can result in additional administrative effort for managing multiple directories. A better solution would be to use Azure Resource Manager (ARM) to create separate resource groups for each division. Resource groups allow for segregation of resources, while still providing a single management interface. Each division can have an administrator assigned to their respective resource group, allowing them to manage the resources for their division. Using Azure Resource Manager (ARM) to create separate resource groups for each division provides an efficient way to segment Azure resources while keeping administrative effort to a minimum. Therefore, the proposed solution of using multiple Azure AD directories does not meet the goal, and using Azure Resource Manager (ARM) to create separate resource groups should be used instead.
  3. Soumyat85 👍 10
    B. No The solution does not meet the goal. Creating several Azure Active Directory (Azure AD) directories would separate the Azure resources into different environments, but it would also increase administrative effort and complexity. Each Azure AD directory would require separate management and administration, leading to duplication of efforts and potential challenges in maintaining consistency across divisions. A more appropriate solution to meet the goal of segmenting Azure for divisions while minimizing administrative effort would be to use Azure RBAC (Role-Based Access Control) and resource groups. By leveraging Azure RBAC, you can assign division-specific administrators with appropriate access permissions to manage the Azure resources within their respective resource groups. This approach allows for segregation of resources based on divisions while maintaining centralized management and reducing administrative overhead.
  4. mmmmmnm 👍 8 Answered B
    The answer is B. They should utilize different subscriptions.
  5. dgk 👍 6 Answered B
    This is achieved by Azure management Groups and not via AAD (Think AWS Organizations). Correct answer is B.
Show 25 more comments
  1. AntonioTech 👍 3
    The answer is B. No Creating multiple Azure Active Directory (Azure AD) directories for each division is not the most suitable solution for achieving segmentation of Azure resources for divisions. While it's technically possible to have separate Azure AD directories for different divisions, this approach can lead to increased administrative complexity and additional management overhead. Managing multiple directories could require more effort and potentially result in a less cohesive and efficient setup. A more suitable solution would involve using Azure RBAC (Role-Based Access Control) to assign appropriate permissions to administrators within a single Azure AD directory. This way, you can achieve the desired segmentation of resources while minimizing administrative effort. Each division's administrator can be assigned specific roles and permissions to manage their respective resources within the same Azure AD directory.
  2. Meesquared 👍 3 Answered B
    Reasoning: Creating multiple Azure AD directories is not the correct way to segment resources for divisions. Azure AD directories are completely isolated tenants. Users and resources cannot be easily shared across directories, so administrative effort would actually increase. ✅ Correct Approach: Use a single Azure AD tenant, and Segment resources using Management Groups, Subscriptions, and Resource Groups. Assign RBAC roles to each division’s administrator. 👉 Therefore, the solution does NOT meet the goal.
  3. SIAMIANJI 👍 3 Answered B
    Only 1 AD is required.
  4. Hanzz 👍 3
    B
  5. FNog 👍 2
    Notice that it doesn't refer to several AAD but several "directories" within an AAD, which, probably, in the end, would do the trick. Yet, to keep the management effort to a minimum, Azure Management Groups is the better option.
  6. sweetheartheart 👍 2 Answered B
    Multiple Azure AD directories = ❌ Not a segmentation best practice. Use Azure hierarchies (Management Groups/Subscriptions/Resource Groups) + RBAC instead.
  7. Ajinkyakore 👍 2
    fool question only why we need several AAD main purpose of AAD is to keep the centralized repository/Directory. so Ans is B-No
  8. Kanders 👍 2
    B. No - does not meet the goal; several Azure AD's are not needed. Preferable to use management groups within ADD.
  9. Fyrus 👍 2 Answered B
    Several AAD? Nope
  10. TungstonTim 👍 1 Answered A
    Azure AD allows for the creation of multiple directories within a single Azure tenant. Each directory can be used to manage the Azure resources used by a specific division, while also providing a separate identity space for each division. This approach allows the company to maintain a centralized management of Azure resources while providing each division with autonomy over their own Azure resources. Each division's administrator would be assigned permissions to manage the resources within their respective Azure AD directory, reducing the administrative effort required by the central IT team. Additionally, Azure AD allows for the creation of custom roles, which can be used to further tailor the access and permissions of each division's administrator.
  11. kahla 👍 1 Answered B
    You're migrating a company to Azure. The company has multiple divisions. Each division should have its own administrator, managing their own resources. The deployment should segregate resources per division. Goal: Allow segmentation with minimal administrative effort. Use several Azure Active Directory (Azure AD) directories, one per division.
  12. Barach Aduot 👍 1 Answered B
    Using several Azure AD (Microsoft Entra ID) directories increases administrative effort. To separate resources for different divisions while keeping management simple, use Azure management groups and subscriptions, with role-based access control (RBAC) to give each division’s administrator the appropriate permissions.
  13. apurba_nag 👍 1 Answered B
    B. No Using multiple Azure AD directories is not the most efficient solution to meet the goal of segmenting Azure for different divisions while keeping administrative efforts to a minimum. A single Azure AD directory with management groups and subscriptions would be a better approach.
  14. Ai_Ai_Ai 👍 1
    Gentlemen, the AAD has nothing to do with it. The question refers to RESOURCES, AAD. The correct solution is ARM - Azure Resource Manager. The company will implement several administrators in each unit, therefore they will each have a separate AAD. Anser is B
  15. AlekksMaciel 👍 1 Answered B
    Using many instances of AADS is not administrator friendly, requires much operational strength and takes a lot of time to set up, since the question asks for the minimum administrative effort, the answer is B.
  16. karthikwarrior 👍 1
    To meet the goal of segmenting Azure resources for divisions while minimizing administrative effort, you should use Azure Management Groups and Subscriptions rather than multiple directories.
  17. suresh_fx 👍 1
    No, the solution does not meet the goal. Creating multiple Azure AD directories would result in administrative overhead and complexity, as each directory would need to be managed separately
  18. Santhosh88 👍 1
    i think that each department can use their own resource group, because they want us to make sure that the Azure deployment you employ allows for Azure to be segmented.
  19. arjunyv2022 👍 1 Answered B
    using multiple Azure AD directories is not a suitable solution for segmenting Azure resources efficiently. The correct approach is to use Management Groups and RBAC.
  20. beepic 👍 1 Answered B
    Azure Active Directory is not a better option to chose if looking for efficiency , ARM (Azure Resource Manager) is the right software to use for segmentation
  21. Mahanad 👍 1 Answered B
    Using several Azure Active Directory Azure AD directories, now called Microsoft Entra ID tenants would increase administrative effort.
  22. Sushant_02 👍 1 Answered B
    They can easily manage multiple admin access through administrative unit or management unit
  23. Morsal Nyoka 👍 1 Answered B
    It is better to upvote an existing comment if you don not have anything to add
  24. Jas001 👍 1 Answered B
    Azure Resource Manager (ARM) provides segmentation and isolation.
  25. sweetheartheart 👍 1
    The goal is to have the administator effort minimum

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Azure Resource Locks for RG Protection

S-grade

Shared Responsibility in Azure SaaS

S-grade

Accessing Azure Cloud Shell via Web Browser

S-grade

Azure VM High Availability SLA Requirements

S-grade

Practice All AZ-900 Questions

Access 90 questions with complete answers and detailed explanations.

View Full AZ-900 Practice Test →

← Back to AZ-900 Study Guide