Azure Resource Hierarchy and Governance Inheritance

Azure management groups are logical containers that help organizations manage access, policy, and compliance across multiple subscriptions. By organizing subscriptions into management groups, you can apply governance conditions such as Azure Policy and role assignments at a higher level, and these conditions cascade by inheritance to all child subscriptions and resources. This ensures consistent governance and security across the organization.

The hierarchy starts with the root management group, which is automatically created for each Microsoft Entra tenant. All management groups and subscriptions fold up into this root, allowing for global policies and role assignments at the directory level. You can create up to six levels of management groups (excluding the root and subscription levels), with each management group having only one parent but potentially many children. Subscriptions and management groups can be moved within the hierarchy, but each can have only one parent at a time.