Azure Resource Hierarchy

A well-planned hierarchy is crucial for efficient management. You define a management group hierarchy to reflect your organization, placing a root management group at the top. Role definitions assigned at a parent management group apply to all its child subscriptions and groups. However, moving a subscription can break these role assignments if the new parent isn't in the role's assignable scope. To move a subscription or management group, you need management group write permissions on both the source and target parent groups, plus role assignment write permissions on the child being moved. The root management group is a special case where no permissions are needed to place new items under it.