Microsoft Azure Solutions Architect Expert AZ-305 Practice Question

Placing all subscriptions in a single root management group makes it possible to assign organization-wide policy once. Creating two child management groups-one for production and one for non-production-and placing the subsidiaries' subscriptions under the appropriate child group lets you apply environment-specific governance without duplicating assignments. A deny policy that blocks public IP addresses can be assigned at the root so every subscription inherits it automatically. A separate modify policy that adds and locks the costCenter tag can be scoped only to the production management group, ensuring that development and test subscriptions are not affected. Because RBAC is granted at the subscription scope, each subsidiary sees only its own subscriptions, satisfying the isolation requirement. The other options either duplicate policy assignments across many scopes, fail to separate production from non-production at the management-group level, or rely on exemptions/Blueprints that increase administration overhead.