Azure Management Groups

Introduction

As enterprises scale their cloud infrastructure, managing multiple Azure subscriptions efficiently becomes a challenge. Azure Management Groups provide a structured way to organize and govern multiple subscriptions under a single umbrella, ensuring consistent policy enforcement and access control. This blog will cover everything you need to know about Azure Management Groups, including their features, hierarchy, best practices, and real-world applications.

What are Azure Management Groups?

Azure Management Groups are containers that help organizations manage access, policies, and compliance across multiple Azure subscriptions. Unlike Resource Groups, which organize resources within a subscription, Management Groups operate above the subscription level, making it easier to enforce governance across the entire organization.

Key Features

• Hierarchical Organization: Manage multiple subscriptions within a structured hierarchy.
• Policy Inheritance: Apply Azure Policy and RBAC (Role-Based Access Control) at the management group level.
• Security & Compliance: Enforce security policies across subscriptions.
• Scalability: Manage up to 10,000 management groups within a tenant.
• Automation: Integrate with Azure Policy, Azure Blueprints, and ARM templates.

Azure Management Groups Hierarchy

Azure Management Groups follow a hierarchical structure that enables efficient governance. The hierarchy is as follows:

1. Root Management Group: The top-level container that encompasses all subscriptions in the tenant.
2. Management Groups: Sub-groups created under the root to organize subscriptions.
3. Subscriptions: Individual Azure subscriptions under specific management groups.
4. Resource Groups: Containers within subscriptions that hold Azure resources.
5. Resources: Individual Azure services like Virtual Machines, Storage Accounts, and App Services.

Example Hierarchy

Root Management Group
│
├── Production Management Group
│   ├── Subscription 1
│   ├── Subscription 2
│
├── Development Management Group
│   ├── Subscription 3
│   ├── Subscription 4

How to Create and Manage Azure Management Groups

1. Creating a Management Group

You can create an Azure Management Group using Azure Portal, Azure PowerShell, or Azure CLI.

Using Azure Portal

1. Go to the Azure Portal.
2. Navigate to Management Groups.
3. Click Add Management Group.
4. Provide a Management Group ID and Display Name.
5. Click Create.

Using Azure CLI

az account management-group create --name "DevGroup" --display-name "Development Group"

Using Azure PowerShell

New-AzManagementGroup -GroupId "DevGroup" -DisplayName "Development Group"

2. Assigning Subscriptions to Management Groups

After creating a management group, you can assign subscriptions to it.

Azure CLI

az account management-group subscription add --name "DevGroup" --subscription "SUBSCRIPTION_ID"

PowerShell

New-AzManagementGroupSubscription -GroupId "DevGroup" -SubscriptionId "SUBSCRIPTION_ID"

Applying Policies and RBAC at the Management Group Level

Applying Azure Policy

To enforce policies across all subscriptions within a management group, you can assign Azure Policy at the management group level.

Example: Enforce Tagging Policy

az policy assignment create --name "RequireTags" --policy "TAG_POLICY_DEFINITION_ID" --scope "/providers/Microsoft.Management/managementGroups/DevGroup"

Assigning RBAC Roles

RBAC permissions can be assigned at the management group level to ensure consistent access control.

Example: Assign Reader Role

az role assignment create --assignee "USER_ID" --role "Reader" --scope "/providers/Microsoft.Management/managementGroups/DevGroup"

Best Practices for Using Azure Management Groups

1. Use a Well-Defined Hierarchy

Organize management groups based on business units, environments (Production, Development, Testing), or geographical locations.

2. Apply Governance at the Top Level

Define security policies, compliance rules, and RBAC at the highest possible level to ensure inheritance across all subscriptions.

3. Leverage Automation

Use Azure Policy, Blueprints, and ARM templates to automate governance and policy enforcement.

4. Monitor and Audit Changes

Enable Azure Monitor, Log Analytics, and Azure Security Center to track changes and enforce compliance.

5. Review and Optimize Regularly

Periodically review the hierarchy and policies to ensure they align with organizational goals.

Conclusion

Azure Management Groups simplify the governance of multiple Azure subscriptions by providing a structured way to manage access, policies, and compliance. By leveraging management groups effectively, organizations can enforce security policies, automate governance, and streamline operations at scale.