Azure Resource Segmentation Strategy
Describe features and tools in Azure for governance and compliance
Answer
Correct answer: B — The solution does not meet the goal because using multiple Azure AD directories increases administrative complexity instead of minimizing it.
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. You are planning to migrate a company to Azure. Each of the company's numerous divisions will have an administrator in place to manage the Azure resources used by their respective division. You want to make sure that the Azure deployment you employ allows for Azure to be segmented for the divisions, while keeping administrative effort to a minimum. Solution: You plan to make use of several Azure Active Directory (Azure AD) directories. Does the solution meet the goal?
Community Insight
The core trap is confusing identity isolation with resource governance; using multiple tenants increases complexity rather than simplifying management.
This question evaluates the correct approach for segmenting Azure resources across multiple divisions while minimizing administrative overhead. The page clarifies why using multiple Azure AD directories fails to meet efficiency goals.
Learners often select 'Yes' assuming that separate directories provide better security or segmentation, ignoring the explicit requirement to minimize administrative effort.
Community Discussion (36 comments)
Morsal Nyoka
👍 1
Selected: B
It is better to upvote an existing comment if you don not have anything to add
Barach Aduot
👍 1
Selected: B
Using several Azure AD (Microsoft Entra ID) directories increases administrative effort. To separate resources for different divisions while keeping management simple, use Azure management groups and subscriptions, with role-based access control (RBAC) to give each division’s administrator the appropriate permissions.
Mxii
👍 1
Selected: B
Coreccccttttttttt
AlekksMaciel
👍 1
Selected: B
Using many instances of AADS is not administrator friendly, requires much operational strength and takes a lot of time to set up, since the question asks for the minimum administrative effort, the answer is B.
Meesquared
👍 3
Selected: B
Reasoning: Creating multiple Azure AD directories is not the correct way to segment resources for divisions. Azure AD directories are completely isolated tenants. Users and resources cannot be easily shared across directories, so administrative effort would actually increase. ✅ Correct Approach: Use a single Azure AD tenant, and Segment resources using Management Groups, Subscriptions, and Resource Groups. Assign RBAC roles to each division’s administrator. 👉 Therefore, the solution does NOT meet the goal.
kahla
👍 1
Selected: B
You're migrating a company to Azure. The company has multiple divisions. Each division should have its own administrator, managing their own resources. The deployment should segregate resources per division. Goal: Allow segmentation with minimal administrative effort. Use several Azure Active Directory (Azure AD) directories, one per division.
beepic
👍 1
Selected: B
Azure Active Directory is not a better option to chose if looking for efficiency , ARM (Azure Resource Manager) is the right software to use for segmentation
mitddgr
👍 1
Selected: B
Azure Active Directory (Azure AD) directories.
sweetheartheart
👍 2
Selected: B
Multiple Azure AD directories = ❌ Not a segmentation best practice. Use Azure hierarchies (Management Groups/Subscriptions/Resource Groups) + RBAC instead.
sweetheartheart
👍 1
The goal is to have the administator effort minimum
arjunyv2022
👍 1
Selected: B
using multiple Azure AD directories is not a suitable solution for segmenting Azure resources efficiently. The correct approach is to use Management Groups and RBAC.
apurba_nag
👍 1
Selected: B
B. No Using multiple Azure AD directories is not the most efficient solution to meet the goal of segmenting Azure for different divisions while keeping administrative efforts to a minimum. A single Azure AD directory with management groups and subscriptions would be a better approach.
Jas001
👍 1
Selected: B
Azure Resource Manager (ARM) provides segmentation and isolation.
Soumyat85
👍 10
B. No The solution does not meet the goal. Creating several Azure Active Directory (Azure AD) directories would separate the Azure resources into different environments, but it would also increase administrative effort and complexity. Each Azure AD directory would require separate management and administration, leading to duplication of efforts and potential challenges in maintaining consistency across divisions. A more appropriate solution to meet the goal of segmenting Azure for divisions while minimizing administrative effort would be to use Azure RBAC (Role-Based Access Control) and resource groups. By leveraging Azure RBAC, you can assign division-specific administrators with appropriate access permissions to manage the Azure resources within their respective resource groups. This approach allows for segregation of resources based on divisions while maintaining centralized management and reducing administrative overhead.
AntonioTech
👍 3
The answer is B. No Creating multiple Azure Active Directory (Azure AD) directories for each division is not the most suitable solution for achieving segmentation of Azure resources for divisions. While it's technically possible to have separate Azure AD directories for different divisions, this approach can lead to increased administrative complexity and additional management overhead. Managing multiple directories could require more effort and potentially result in a less cohesive and efficient setup. A more suitable solution would involve using Azure RBAC (Role-Based Access Control) to assign appropriate permissions to administrators within a single Azure AD directory. This way, you can achieve the desired segmentation of resources while minimizing administrative effort. Each division's administrator can be assigned specific roles and permissions to manage their respective resources within the same Azure AD directory.
BeauChateau
👍 45
Selected: B
No, the solution does not meet the goal. Using multiple Azure Active Directory (Azure AD) directories to segment Azure resources for each division may not be the most efficient way to manage the resources. While it does provide segregation of resources and administrative control, it can result in additional administrative effort for managing multiple directories. A better solution would be to use Azure Resource Manager (ARM) to create separate resource groups for each division. Resource groups allow for segregation of resources, while still providing a single management interface. Each division can have an administrator assigned to their respective resource group, allowing them to manage the resources for their division. Using Azure Resource Manager (ARM) to create separate resource groups for each division provides an efficient way to segment Azure resources while keeping administrative effort to a minimum. Therefore, the proposed solution of using multiple Azure AD directories does not meet the goal, and using Azure Resource Manager (ARM) to create separate resource groups should be used instead.
karthikwarrior
👍 1
To meet the goal of segmenting Azure resources for divisions while minimizing administrative effort, you should use Azure Management Groups and Subscriptions rather than multiple directories.
Santhosh88
👍 1
i think that each department can use their own resource group, because they want us to make sure that the Azure deployment you employ allows for Azure to be segmented.
Sushant_02
👍 1
Selected: B
They can easily manage multiple admin access through administrative unit or management unit
glazdub
👍 1
Selected: B
Answer is B only one AAD is sufficient
navid1365
👍 1
Selected: B
B is the correct answer
suresh_fx
👍 1
No, the solution does not meet the goal. Creating multiple Azure AD directories would result in administrative overhead and complexity, as each directory would need to be managed separately
Kanders
👍 2
B. No - does not meet the goal; several Azure AD's are not needed. Preferable to use management groups within ADD.
TungstonTim
👍 1
Selected: A
Azure AD allows for the creation of multiple directories within a single Azure tenant. Each directory can be used to manage the Azure resources used by a specific division, while also providing a separate identity space for each division. This approach allows the company to maintain a centralized management of Azure resources while providing each division with autonomy over their own Azure resources. Each division's administrator would be assigned permissions to manage the resources within their respective Azure AD directory, reducing the administrative effort required by the central IT team. Additionally, Azure AD allows for the creation of custom roles, which can be used to further tailor the access and permissions of each division's administrator.
Ai_Ai_Ai
👍 1
Gentlemen, the AAD has nothing to do with it. The question refers to RESOURCES, AAD. The correct solution is ARM - Azure Resource Manager. The company will implement several administrators in each unit, therefore they will each have a separate AAD. Anser is B
SIAMIANJI
👍 3
Selected: B
Only 1 AD is required.
FNog
👍 2
Notice that it doesn't refer to several AAD but several "directories" within an AAD, which, probably, in the end, would do the trick. Yet, to keep the management effort to a minimum, Azure Management Groups is the better option.
warbon
👍 1
Selected: B
No, does not meet the goal.
Sudi_26
👍 1
B. Several AD are not required.
dgk
👍 6
Selected: B
This is achieved by Azure management Groups and not via AAD (Think AWS Organizations). Correct answer is B.
Ajinkyakore
👍 2
fool question only why we need several AAD main purpose of AAD is to keep the centralized repository/Directory. so Ans is B-No
rameshsee
👍 1
Selected Answer: B
Fyrus
👍 2
Selected: B
Several AAD? Nope
mmmmmnm
👍 8
Selected: B
The answer is B. They should utilize different subscriptions.
Georgess
👍 171
The proposed solution is: You plan to make use of several Azure Active Directory (Azure AD) directories. I think the key word is SEVERAL. Why in the world a company will create SEVERAL AADs when it can create a single AAD and organize its divisions right there? This is why I consider the correct answer B (No).
Hanzz
👍 3
B
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The solution does not meet the goal because creating multiple Azure Active Directory (Azure AD) directories results in separate, isolated tenants. This architecture significantly increases administrative effort due to the need to manage distinct identities, policies, and settings for each directory, violating the requirement to keep effort minimal. Instead, a single Azure AD tenant should be used, leveraging Management Groups, Subscriptions, and Role-Based Access Control (RBAC) to segment resources efficiently.Why the Other Options Are Wrong
Option A ('Yes') is incorrect because it assumes segmentation equals isolation. While multiple directories do isolate data, they create silos that make cross-divisional collaboration and centralized administration difficult and costly. The prompt explicitly demands minimum administrative effort, which multi-tenant setups cannot provide.Community Comment Notes
Community consensus strongly supports Option B. As Georgess noted, the keyword 'SEVERAL' implies unnecessary complexity compared to organizing within a single directory. Other users like Meesquared highlighted that multiple directories prevent easy sharing of users and resources, leading to duplicated efforts. Comments from dgk and mmmmmnm correctly point out that Management Groups are the appropriate tool for this hierarchy, analogous to AWS Organizations.Official Reference
Exam Strategy
Always prioritize the constraint 'minimize administrative effort' when choosing between architectural options. In Azure, prefer hierarchical governance tools (Management Groups/Subscriptions) over identity isolation (multiple tenants) for internal organizational segmentation.
Frequently Asked Questions
Why can't I use multiple Azure AD directories for segmentation?
Multiple directories create isolated tenants, requiring separate management of users, groups, and policies, which increases administrative effort rather than reducing it.
What is the best way to segment resources for different divisions?
Use a single Azure AD tenant with Management Groups and Subscriptions to enforce hierarchy and RBAC permissions, allowing centralized management with granular access control.
Related Analysis
Practice All AZ-900 Questions
Access 90 questions with complete answers and detailed explanations.
View Full AZ-900 Practice Test →