Diagram
A top-down hierarchy showing Azure resources flowing from the Root Management Group to Management Groups, Subscriptions, Resource Groups, and finally Resources, illustrating how policies and permissions inherit downwards.
Hierarchy and Structure of Management Groups
Management groups form a tree-like hierarchical structure. The root management group sits at the top and contains all other groups and subscriptions by default. You can nest additional management groups under it to reflect your organization's structure. Only two types of entities can be direct children: other management groups and subscriptions. Each child can have only one parent.
When you place a subscription under a management group, it inherits all the access permissions and policies from that parent. This inheritance flows downward and cannot be bypassed, ensuring consistent governance. The full Azure hierarchy is: Management groups > Subscriptions > Resource groups > Resources. This model means policies and permissions set at a high-level management group apply to every resource beneath it, simplifying overall control.
Domain 6 of 7
11 practice questions
Practice this DomainLast updated