Management groups
What it is
Management groups are containers you use to organize subscriptions into a hierarchy so you can apply governance (Azure Policy, RBAC, budgets) once at a higher level and have it flow down to every subscription beneath. Above them all sits a root management group.
Why it exists
A large organization with many Azure subscriptions can’t configure policy/RBAC per-subscription. Management groups let you apply one policy or role assignment at the root (or a subtree) and have it inherit to all child subscriptions — a single point of control at scale.
Key ideas
- Tree of subscriptions — hierarchy: root management group → management groups → subscriptions (and logical groups beneath them). Up to 6 levels of depth (excluding the root and the subscription level).
- Each subscription is under exactly one management group; management groups can nest.
- Inheritance — Azure Policy and RBAC assignments made at a management group are inherited by every subscription/resource below it.
- The root management group is created for you; assigning an Owner/User Access Administrator over the root gives org-wide control (grant sparingly).
- Used for consolidated cost/budget and compliance across teams/units.
How it fits (diagram)
Diagrams courtesy of Microsoft Learn / Azure docs: governance/management-groups/overview
Exam notes
- Management groups manage subscriptions; resource groups manage resources — two different levels of the same hierarchy.
- Max 6 levels of management-group depth.
- Assign Azure Policy at a management group to enforce compliance uniformly instead of per-subscription.
- Group subscriptions by function, geography, or environment for logical organization & governance.
Related
Path MOC · subscription · scope · azure-policy · rbac
📘 Source: Microsoft Learn — Management Groups