Azure Management Groups, Subscriptions and Resource Tagging

Structuring Management Groups, Subscriptions, and Resource Groups

Organizing Hierarchies and Workloads

To design an Azure environment, you must map your organization's structure into a logical hierarchy. This involves analyzing departments, projects, and environments (like production or development) to decide how they fit into management groups and subscriptions. Management groups act as containers above subscriptions, allowing you to apply governance policies and permissions across many subscriptions at once. Subscriptions are the fundamental units for billing and resource limits, while resource groups are used inside subscriptions to isolate specific workloads and provide a scope for applying policies.

Designing the Management Group Hierarchy

A well-planned hierarchy is crucial for efficient management. You define a management group hierarchy to reflect your organization, placing a root management group at the top. Role definitions assigned at a parent management group apply to all its child subscriptions and groups. However, moving a subscription can break these role assignments if the new parent isn't in the role's assignable scope. To move a subscription or management group, you need management group write permissions on both the source and target parent groups, plus role assignment write permissions on the child being moved. The root management group is a special case where no permissions are needed to place new items under it.

Allocating Resource Groups for Isolation and Policy

Within a subscription, you create resource groups to logically group resources that share a common lifecycle, like all components of a single application. This grouping aids in deployment, deletion, and policy management. Resource groups also serve as a key scope for applying Azure Policy, allowing you to enforce rules on a specific set of resources. The design goal is to balance isolation needs with management overhead, ensuring policies are applied at the correct level for governance.

Creating a Strategy for Resource Tagging

Resource tagging involves applying key-value pairs to resources, groups, and subscriptions to organize and manage them. A consistent tagging taxonomy is vital for automated cost allocation, governance enforcement, and tracking resources. Common tags include "CostCenter" for billing, "Environment" (e.g., Prod, Dev), and "ApplicationOwner." Tags should be applied when resources are first created and enforced through policy to ensure compliance. This strategy enables operations like reporting costs by department or automatically shutting down development resources on weekends.

Understanding Limitations and Ensuring Compliance

There are important technical limits to consider. When creating custom roles, only one management group can be defined in the role's assignable scopes initially. Furthermore, custom roles that include DataActions (permissions for data operations) cannot be assigned at the management group scope at all. When restructuring your hierarchy, you must proactively manage permissions to avoid broken role assignments, which can disrupt access. Solutions include removing the assignment before a move, adding the new target to the role's scope, or updating the scope to the root management group.

Auditing and Monitoring the Structure

Azure provides tools to audit your management structure. All events, such as role assignments or policy changes within management groups, are recorded in activity logs. You can query these logs in Azure Monitor to track governance actions. For ongoing monitoring, you can configure diagnostic settings to send these log entries to a Log Analytics workspace, Azure Storage, or Azure Event Hubs. This auditing capability is essential for maintaining transparency, proving compliance, and troubleshooting permission or policy issues across your organized hierarchy.