2.1.4.4. Configure Management Groups

💡 First Principle: Azure Management Groups provide a hierarchical structure above subscriptions, enabling the efficient application of governance, compliance, and access management policies at enterprise scale.

Scenario: Your organization wants to apply a specific set of security policies to all "Production" subscriptions, ensuring they are always encrypted and highly available. Separately, "Development" subscriptions should have different, less restrictive policies.

What It Is: Management Groups are containers for subscriptions.

Hierarchy: You can nest management groups up to six levels deep, forming a flexible tree. Each group can contain other management groups or subscriptions, supporting granular policy and access assignment.

Key Benefits:

• Unified Policy Enforcement: Assign Azure Policy or Initiatives at the management group level; all underlying subscriptions and resources inherit these settings.
• Centralized RBAC: Role-Based Access Control (RBAC) assignments at the management group level cascade to all contained subscriptions, ensuring consistent access control.
• Simplified Compliance: Apply regulatory or security policies once at the management group, streamlining compliance across the hierarchy.

Practical Implementation: Creating a Management Group with Azure CLI

# Create a new management group
az account management-group create --name "Production-MG"
# Move a subscription into the new management group
az account management-group subscription add --name "Production-MG" --subscription "your-production-subscription-id"

⚠️ Common Pitfall: Creating a management group hierarchy that is too complex or doesn't align with the organization's actual governance structure, leading to confusion and ineffective policy application.

Key Trade-Offs:

• Centralized Control vs. Delegated Autonomy: A strict management group hierarchy provides strong central control but may limit the autonomy of individual teams. The design should balance central governance with necessary team flexibility.

Reflection Question: How do Azure management groups, by providing a hierarchical structure above subscriptions, fundamentally enable enterprise-scale governance, ensuring consistent access, policies, and compliance across diverse environments?