Exam AZ-900 topic 1 question 8 discussion

The proposed solution is: You plan to make use of several Azure Active Directory (Azure AD) directories. I think the key word is SEVERAL. Why in the world a company will create SEVERAL AADs when it can create a single AAD and organize its divisions right there? This is why I consider the correct answer B (No).

No, the solution does not meet the goal. Using multiple Azure Active Directory (Azure AD) directories to segment Azure resources for each division may not be the most efficient way to manage the resources. While it does provide segregation of resources and administrative control, it can result in additional administrative effort for managing multiple directories. A better solution would be to use Azure Resource Manager (ARM) to create separate resource groups for each division. Resource groups allow for segregation of resources, while still providing a single management interface. Each division can have an administrator assigned to their respective resource group, allowing them to manage the resources for their division. Using Azure Resource Manager (ARM) to create separate resource groups for each division provides an efficient way to segment Azure resources while keeping administrative effort to a minimum. Therefore, the proposed solution of using multiple Azure AD directories does not meet the goal, and using Azure Resource Manager (ARM) to create separate resource groups should be used instead.

Multiple Azure AD directories = ❌ Not a segmentation best practice. Use Azure hierarchies (Management Groups/Subscriptions/Resource Groups) + RBAC instead.

using multiple Azure AD directories is not a suitable solution for segmenting Azure resources efficiently. The correct approach is to use Management Groups and RBAC.

B. No Using multiple Azure AD directories is not the most efficient solution to meet the goal of segmenting Azure for different divisions while keeping administrative efforts to a minimum. A single Azure AD directory with management groups and subscriptions would be a better approach.

Azure Resource Manager (ARM) provides segmentation and isolation.

B. No The solution does not meet the goal. Creating several Azure Active Directory (Azure AD) directories would separate the Azure resources into different environments, but it would also increase administrative effort and complexity. Each Azure AD directory would require separate management and administration, leading to duplication of efforts and potential challenges in maintaining consistency across divisions. A more appropriate solution to meet the goal of segmenting Azure for divisions while minimizing administrative effort would be to use Azure RBAC (Role-Based Access Control) and resource groups. By leveraging Azure RBAC, you can assign division-specific administrators with appropriate access permissions to manage the Azure resources within their respective resource groups. This approach allows for segregation of resources based on divisions while maintaining centralized management and reducing administrative overhead.

The answer is B. No Creating multiple Azure Active Directory (Azure AD) directories for each division is not the most suitable solution for achieving segmentation of Azure resources for divisions. While it's technically possible to have separate Azure AD directories for different divisions, this approach can lead to increased administrative complexity and additional management overhead. Managing multiple directories could require more effort and potentially result in a less cohesive and efficient setup. A more suitable solution would involve using Azure RBAC (Role-Based Access Control) to assign appropriate permissions to administrators within a single Azure AD directory. This way, you can achieve the desired segmentation of resources while minimizing administrative effort. Each division's administrator can be assigned specific roles and permissions to manage their respective resources within the same Azure AD directory.

Passed, AD -> Entra

To meet the goal of segmenting Azure resources for divisions while minimizing administrative effort, you should use Azure Management Groups and Subscriptions rather than multiple directories.

i think that each department can use their own resource group, because they want us to make sure that the Azure deployment you employ allows for Azure to be segmented.

No need to use several AAD

B is the correct answer

I would never go with multiple AAD

Answer is B.

They can easily manage multiple admin access through administrative unit or management unit

Answer is B only one AAD is sufficient