The hierarchy starts with the root management group, which is automatically created for each Microsoft Entra tenant. All management groups and subscriptions fold up into this root, allowing for global policies and role assignments at the directory level. You can create up to six levels of management groups (excluding the root and subscription levels), with each management group having only one parent but potentially many children. Subscriptions and management groups can be moved within the hierarchy, but each can have only one parent at a time.
When designing a hierarchy, consider segmenting management groups by business units, environments, or regulatory boundaries to reflect organizational needs. Limit depth to three levels including the root to avoid complexity and operational confusion. Apply policies and RBAC assignments only at scopes where they are truly needed, especially at the root, to minimize unintended impacts. Test enterprise-wide changes in a controlled environment before applying them globally.
Inheritance is a key concept in management group hierarchies. Policies and role assignments applied at a parent management group automatically propagate to all descendant groups and subscriptions. For example, applying a policy to restrict VM creation regions at a parent group will enforce that restriction across all child resources, and subscription owners cannot override it. This inheritance ensures consistent compliance and security, but also means changes at higher levels can have broad impact.
Role assignments and custom roles require careful planning. Azure RBAC roles can be assigned at any level in the hierarchy, and these assignments inherit down to all child resources. However, custom roles have limitations: only one management group can be defined in the assignable scopes of a custom role, custom roles with DataActions cannot be assigned at the management group level, and moving subscriptions or management groups may break the path between role definitions and assignments, requiring updates to role scopes or assignments.
Applying Governance through Management Groups
Management groups are governance containers that allow administrators to manage access, policies, and compliance across multiple Azure subscriptions efficiently. By organizing subscriptions into these groups, any governance conditions applied at the top level automatically cascade to all associated subscriptions and resources through inheritance. This structure provides enterprise-grade management at scale, ensuring that security and operational standards remain consistent throughout an entire organization.
The Azure hierarchy begins with a single root management group that automatically contains every subscription and group within the directory. This tree-like structure supports a maximum depth of six levels, excluding the root and subscription levels, allowing for complex organizational mapping. Each management group or subscription can have only one parent, which maintains a clear and predictable path for inherited permissions.
Administrators leverage Azure Policy and Role-Based Access Control (RBAC) at the management group level to enforce consistent security and compliance across all descendant resources. For instance, a policy assigned to a group can restrict resource deployment to specific regions, and this restriction cannot be altered by lower-level subscription owners. A single role assignment at this level grants users access to all nested subscriptions, significantly reducing the administrative overhead of manual scripting.
While custom roles can be defined with a management group as an assignable scope, there are specific technical limitations to ensure hierarchy stability. You can only define one management group in the assignable scope of a new custom role to prevent role definitions from breaking if a subscription is moved. Additionally, custom roles assigned at the management group scope cannot include DataActions, which are permissions specifically designed for interacting with data inside resources.
Moving subscriptions or groups within the hierarchy requires specific write permissions on the child object, the current parent, and the target parent management group. To further secure the environment, tenant administrators can adjust hierarchy settings to require specific authorization for creating new groups or to designate a default management group for new subscriptions. These proactive controls ensure that all new assets are immediately governed by the organization's mandatory security and compliance frameworks.
Implement and Manage Management Groups
Management groups in Azure are used to organize resources and apply governance policies across multiple subscriptions. They help in structuring resources hierarchically, making it easier to manage and control access.
To configure management groups, you need to understand their structure and purpose. Management groups allow you to create a hierarchy for your Azure resources, which can be used to apply policies and manage access. This hierarchical structure helps in organizing resources effectively and ensures that governance policies are consistently applied.
Assigning roles and permissions within management groups is crucial for maintaining control over your Azure environment. You can assign roles at different levels of the hierarchy, ensuring that users have the appropriate access to resources. This helps in enforcing governance policies and maintaining security across your subscriptions.
Governance policies are essential for maintaining compliance and security in your Azure environment. By applying these policies at the management group level, you can ensure that they are consistently enforced across all subscriptions. This helps in maintaining a standardized approach to resource management and reduces the risk of non-compliance.
StudyCerts
StudyCerts