Azure Management Hierarchy and Inheritance

Management groups provide a hierarchy to organize and govern multiple subscriptions. By creating a hierarchy, you can apply policies and RBAC assignments at higher levels, which are then inherited by all descendant subscriptions and resources. The root management group sits at the top of each Microsoft Entra directory and is used for global policy and access assignments. It is best practice to restrict the root management group to essential, low-impact policies and always test changes before applying them enterprise-wide.