AZ-900 Microsoft Azure Fundamentals Exam

Creating and Managing Management Groups

Management groups in Azure are containers that organize multiple subscriptions into a hierarchy. You create and manage them using the Azure portal, Azure PowerShell, or the Azure CLI. To add a subscription in the portal, you navigate to Management groups, select a parent group, and choose "Add subscription." Removing or moving a subscription follows a similar process. From the command line, you use specific commands like New-AzManagementGroupSubscription in PowerShell or az account management-group subscription add in the CLI to script these actions.

You can also rename or delete a management group. Renaming helps keep your hierarchy clear as it evolves, and you can do this through the portal's details page or via update commands in PowerShell or CLI. Deleting a group requires that it has no child groups or subscriptions and that you have the proper permissions, such as Owner or Contributor. Always check for dependencies before deletion to avoid losing your governance scope.

Scenarios and Use Cases

Management groups are especially beneficial in large organizations with many subscriptions. A common use case is grouping subscriptions by department, such as Finance, IT, or Marketing. Another is organizing by environment, like Development, Testing, and Production. This structure ensures every subscription in a group automatically inherits the same policies and access controls, simplifying compliance and cost management.

They are also valuable during organizational changes. You can move subscriptions between management groups as business units evolve without having to reconfigure each subscription individually. This flexibility improves the overall security posture by allowing centralized role-based access control (RBAC) and policy definitions. Management groups reduce administrative effort by eliminating repetitive tasks across many subscriptions.

Policy and Access Management

A key function of management groups is applying Azure Policy and role-based access control (RBAC) at a high level. When you set a policy or assign a role at the management group, all child subscriptions inherit those settings. This ensures consistent compliance and uniform permissions across your entire environment. For example, you can enforce rules about allowed resource types or required tags just once at the parent group.

To move a subscription or child management group, you need specific write permissions on the child, the current parent, and the target parent management group. These permissions include actions like Microsoft.management/managementgroups/write. An exception exists for the root management group, where these checks are not required. This permission structure ensures you can reorganize your hierarchy without losing control or violating policy enforcement.

Purpose and Benefits of Management Groups

The primary purpose of Azure management groups is to provide a higher-level container for organizing and governing multiple subscriptions. They sit above subscriptions in the Azure hierarchy, allowing you to manage access, policies, and compliance from a single point. This centralized approach reduces complexity and increases visibility across an organization.

The main benefits include improved governance, consistent policy enforcement, and streamlined resource management. By applying company-wide rules at the management group level, you ensure all subscriptions comply automatically. This eliminates the need for repetitive, manual configuration on each subscription. Management groups enable enterprise-grade management at scale, helping maintain security and reduce administrative overhead.

Hierarchy and Structure of Management Groups

Management groups form a tree-like hierarchical structure. The root management group sits at the top and contains all other groups and subscriptions by default. You can nest additional management groups under it to reflect your organization's structure. Only two types of entities can be direct children: other management groups and subscriptions. Each child can have only one parent.

When you place a subscription under a management group, it inherits all the access permissions and policies from that parent. This inheritance flows downward and cannot be bypassed, ensuring consistent governance. The full Azure hierarchy is: Management groups > Subscriptions > Resource groups > Resources. This model means policies and permissions set at a high-level management group apply to every resource beneath it, simplifying overall control.