Azure Subscription Hierarchy

Azure subscriptions are part of a larger hierarchy that starts with the root management group, followed by management groups, then subscriptions, and finally resource groups that contain individual resources. This layered approach lets you scale governance from the company level down to specific workloads. Subscriptions inherit policies and permissions from their parent management group, so rules applied at a higher level automatically flow down to all child subscriptions.

Management groups sit above subscriptions and bundle them under a single governance umbrella. Applying a policy or access control at the management group level ensures consistent enforcement across all its subscriptions. You can move subscriptions between management groups using the Azure portal, Azure PowerShell, or the Azure CLI. When moving, you need permission at the child subscription or management group, the target parent, and the current parent, ensuring proper access control is maintained.