An enterprise organization operates multiple Azure subscriptions across several business units, including Finance, Marketing, and Engineering. The cloud governance team must centrally manage access control, enforce compliance rules using Azure Policy, and apply standard governance settings across all subscriptions without having to configure each subscription individually. Which Azure architectural component should the organization implement to organize and govern these subscriptions hierarchically?

Management groups: ### What Management Groups Are **Azure Management Groups** are governance containers positioned above subscriptions in the Azure resource hierarchy. They provide a level of organization and management that allows enterprises to structure, manage, and govern multiple subscriptions efficiently as a unified tree-like hierarchy. ### How Management Groups Meet the Requirements By grouping subscriptions under **management groups**, the organization can attach access permissions (**Azure role-based access control** or **Azure RBAC**) and compliance policies (**Azure Policy**) at the management group scope. All subscriptions and child management groups placed within that structure automatically inherit those settings, fulfilling the need to govern all business units consistently without repetitive individual configurations. ### Key Advantages and Capabilities - **Hierarchical Governance**: Supports structures up to six levels deep, allowing organizations to mirror organizational charts, geographic units, or development environments. - **Policy Inheritance**: Applying an Azure Policy definition or initiative at a higher-level management group automatically cascades enforcement down to every child subscription, resource group, and individual resource. - **Centralized Role Assignments**: Users, groups, and service principals assigned access at a management group level inherit those permissions across all nested subscriptions. - **Scalable Enterprise Management**: Simplifies management across hundreds or thousands of subscriptions by centralizing administrative overhead. ### Why This Is Optimal Using management groups provides true at-scale governance and policy inheritance above subscriptions, which eliminates the administrative burden and potential security gaps associated with configuring subscriptions individually.

Azure Management Groups Subscription Governance 2 | Start here! Get your feet wet with the Microsoft cloud and begin your journey to earning your Microsoft Certified: Azure Fundamentals certification!