📖 What is Azure Management Groups?
Azure Management Groups are containers that help you manage access, policy, and compliance for multiple Azure subscriptions. By organizing subscriptions into a hierarchy, you can apply governance settings at a higher level that automatically inherit down to all child subscriptions.
"If the scenario involves managing multiple subscriptions with a single policy or set of permissions, Management Groups are almost always the correct answer."
📚 Certification: Microsoft Azure Fundamentals (AZ-900)
🔑 What are the Key Concepts of Azure Management Groups?
- ▸ Hierarchical Structure: Management groups create a tree-like hierarchy where subscriptions are placed under groups, allowing for organized governance across an entire organization.
- ▸ Policy Inheritance: Azure Policies applied at the management group level are automatically inherited by all child groups and subscriptions, ensuring consistent compliance.
- ▸ RBAC at Scale: Role-Based Access Control permissions assigned at a management group level apply to all subscriptions within that group, simplifying identity management.
- ▸ Governance Efficiency: This tool eliminates the need to manually configure settings for each individual subscription, reducing administrative overhead and human error.
- ▸ Subscription Mapping: Each Azure subscription can belong to only one management group, though management groups can be nested up to six levels deep.
🎯 How does Azure Management Groups appear on the AZ-900 Exam?
You may be asked to identify the best tool for a company with dozens of subscriptions that needs to enforce a 'Allowed Locations' policy across all of them simultaneously to ensure regulatory compliance.
A scenario might describe a large organization wanting to grant a central security team read-only access to every subscription in the company without managing individual permissions for each subscription manually.
❓ Frequently Asked Questions
How do Management Groups differ from Resource Groups?
Management Groups are used to manage multiple subscriptions and sit at the top of the hierarchy. Resource Groups are used to organize resources within a single subscription and sit at the bottom.
Does applying a policy at the Root Management Group affect everything?
Yes, any policy or RBAC assignment applied at the Root Management Group level is inherited by every single subscription in the Azure tenant, regardless of their nesting level.