Exam AZ-305 topic 4 question 47 discussion

Define: Root Management Groups Assignments: Subscriptons. In the dark MS language: "Assigning a blueprint definition to a management group means the assignment object exists at the management group. The deployment of artifacts still targets a subscription." https://docs.microsoft.com/en-us/azure/governance/blueprints/overview#blueprint-assignment

root management groups and subscriptions. appeared in exam, 10/14/2022. I passed with 946/1000 and there were only 1~2 new questions but others were all from AZ-305 dump.

WRONG 1. The root management group 2. The subscriptions

The root management group The subscriptions

Final Answer: Define: Root Management Groups Assignments: Subscriptons.

On a side note, AZ Blueprints are being deprecated, so probably we won't see many questions relating to them in upcoming exams. Source: https://learn.microsoft.com/en-us/azure/governance/blueprints/overview

Define: Root Management Groups Assignments: Subscriptons Tested in lab, while assigning first thing to select is Subscriptions. It is multi-select, so you can choose as many subs as you want. In the example scenario since there are like 100s of subs, i would assume the admin will use CLI or powershell to provide the sub names.

Level at which to define the blueprints: The root management group Level at which to create the blueprint assignments: The child management groups

Seems to be subscription for box 2, management group is assignable but it will not inherit to all subscriptions but just one default: https://learn.microsoft.com/en-us/answers/questions/420039/blueprint-assignment-at-management-group-level

1. Level at which to define the blueprints: b. the root management group Defining the blueprints at the root management group level will ensure the blueprints are available to all child management groups and subscriptions, maintaining consistency and minimizing the number of blueprint definitions needed. 2. Level at which to create the blueprint assignments: b. the root management group Assigning the blueprints at the root management group level will apply the blueprints to all child management groups and subscriptions, ensuring a consistent governance structure and minimizing the number of blueprint assignments. (Assigning at the Sub level would mean about 50 assignments which is not what the question asks)

Each Published Version of a blueprint can be assigned (with a max name length of 90 characters) to an existing management group or subscription. https://learn.microsoft.com/en-us/azure/governance/blueprints/overview#blueprint-assignment

Each Published Version of a blueprint can be assigned (with a max name length of 90 characters) to an existing management group or subscription (From the link given in the answer). So i think given answer is supported by MS documentation (although I've not tried it to be fair).

In my lab with 1 Root MG (duh), 3 Child MGs, each Child MG has 1 Subscription each. - When creating a BP I can only DEFINE it on a SINGLE Child MG, NOT the Root MG (it is greyed out), even if the Root MG has a subscription I still cannot DEFINE the BP on the Root MG. Also, tired in PS & also cannot DEFINE on the Root MG "scope is invalid". NOTE: Once a BP is DEFINED during creation it CANNOT be re-DEFINED (greyed out). Ø A BP CANNOT be DEFINED on the Root MG or on more than a SINGLE Child MG, I need 3 BPs, 1 for each Child MG - During creating of the BP I can optionally DEFINE it on any of the individual Subscriptions (but I don't because I'm pretending my MGs have multiple Subscriptions) - I publish the BP & then can ASSIGN it ONLY to any or all of the Subscriptions below that MG. Ø A BP can ONLY be ASSIGNED to a Subscription(s), a BP cannot be ASSIGNED to MGs

Got this on 14-Apr-2023

I think the provided answer is correct, blueprints can be assigned at management group level: https://learn.microsoft.com/en-us/azure/governance/blueprints/overview#blueprint-assignment

1. Root MG 2. Subscriptions https://learn.microsoft.com/en-us/azure/governance/blueprints/overview#blueprint-definition-locations When creating a blueprint definition, you'll define where the blueprint is saved. Blueprints can be saved to a management group or subscription that you have Contributor access to. If the location is a management group, the blueprint is available to assign to any child subscription of that management group. https://learn.microsoft.com/en-us/azure/governance/blueprints/overview#blueprint-assignment Assigning a blueprint definition to a management group means the assignment object exists at the management group. The deployment of artifacts still targets a subscription. https://learn.microsoft.com/en-us/azure/governance/blueprints/overview#permissions-in-azure-blueprints As blueprint assignments are created on a subscription, the blueprint assign and unassign permissions must be granted on a subscription scope or be inherited onto a subscription scope.

ChatGPT: To meet the requirements, you should include the following in the solution: Define the Blueprints at the root management group level to ensure that the configurations are consistent across all the subscriptions and resource groups. Create the blueprint assignments at the child management group level to apply the blueprint to all the subscriptions and resource groups under each child management group. Therefore, you should select: b. The root management group for "Level at which to define the blueprints?" a. The child management groups for "Level at which to create the blueprint assignments?"