Microsoft Azure Solutions Architect Expert AZ-305 Practice Question

Placing a dedicated management group under the tenant root for each business unit and creating Dev and Prod child management groups inside each one lets you segregate environments while still rolling up to a single organizational hierarchy. Assigning the corporate Azure Policy initiative and the GlobalSecurity Reader role at the tenant root propagates these settings to every descendant management group and subscription, so IT sets them only once. Business-unit administrators can still manage more-granular RBAC on resources inside their own subscriptions because lower-level assignments can add (but not remove) permissions. Designing per-environment management groups under a single branch, using separate tenants, or assigning policy and roles on every individual subscription would all increase administrative overhead or break the requirement for a single corporate policy scope.