Subscriptions and management groups in Azure - Commands & Configuration

Introduction

Managing many Azure subscriptions can get confusing. Management groups help organize subscriptions so you can apply rules and policies to many subscriptions at once.

When you have multiple Azure subscriptions for different teams or projects and want to organize them.

When you want to apply the same security rules or policies to many subscriptions easily.

When you want to see billing or usage information grouped by departments or business units.

When you want to control who can manage subscriptions in a large organization.

When you want to simplify compliance by grouping subscriptions under common rules.

Commands

This command creates a new management group named 'example-mg' with a friendly display name. Management groups help organize subscriptions.

Terminal

az account management-group create --name example-mg --display-name "Example Management Group"

Expected Output

{

  "id": "/providers/Microsoft.Management/managementGroups/example-mg",

  "name": "example-mg",

  "properties": {

    "displayName": "Example Management Group",

    "details": {

      "parent": null

    }

  },

  "type": "Microsoft.Management/managementGroups"

}

→

--name - Sets the unique ID for the management group.

→

--display-name - Sets the friendly name shown in the Azure portal.

This command adds an existing subscription to the management group 'example-mg' so it inherits policies and access controls.

Terminal

az account management-group subscription add --name example-mg --subscription 12345678-1234-1234-1234-123456789abc

Expected Output

No output (command runs silently)

→

--name - Specifies the management group to add the subscription to.

→

--subscription - Specifies the subscription ID to add.

This command shows details about the management group 'example-mg', including its subscriptions and hierarchy.

Terminal

az account management-group show --name example-mg

Expected Output

{

  "id": "/providers/Microsoft.Management/managementGroups/example-mg",

  "name": "example-mg",

  "properties": {

    "displayName": "Example Management Group",

    "details": {

      "children": [

        {

          "id": "/subscriptions/12345678-1234-1234-1234-123456789abc",

          "type": "Subscription"

        }

      ],

      "parent": null

    }

  },

  "type": "Microsoft.Management/managementGroups"

}

→

--name - Specifies the management group to show.

This command deletes the management group 'example-mg'. You must remove or move subscriptions before deleting.

Terminal

az account management-group delete --name example-mg

Expected Output

No output (command runs silently)

→

--name - Specifies the management group to delete.

Key Concept

If you remember nothing else from this pattern, remember: management groups let you organize and control many Azure subscriptions together easily.

Common Mistakes

Trying to delete a management group that still has subscriptions assigned.

Azure does not allow deleting management groups that contain subscriptions.

Remove or move all subscriptions out of the management group before deleting it.

Using subscription names instead of subscription IDs when adding to a management group.

The command requires the subscription ID, not the display name, so it will fail if names are used.

Always use the subscription's GUID ID when adding it to a management group.

Not having sufficient permissions to create or manage management groups.

You need specific Azure roles like 'Management Group Contributor' to manage groups; otherwise commands fail.

Ensure your Azure account has the required permissions before running management group commands.

Summary

Create a management group to organize subscriptions with 'az account management-group create'.

Add subscriptions to the group using 'az account management-group subscription add'.

View the group's details and subscriptions with 'az account management-group show'.

Delete a management group only after removing all subscriptions from it.

Practice

1. What is the main purpose of an Azure subscription?

easy

A. To group cloud resources for billing and access control

B. To organize management groups in a hierarchy

C. To apply policies across multiple tenants

D. To create virtual networks automatically

Solution

1. Step 1: Understand the role of subscriptions

   Subscriptions in Azure are containers that group resources for billing and access control.

2. Step 2: Differentiate from management groups

   Management groups organize subscriptions, not the other way around.

3. Final Answer:

   To group cloud resources for billing and access control -> Option A

4. Quick Check:

   Subscription = billing and access grouping [OK]

Hint: Subscriptions group resources for billing and access [OK]

Common Mistakes:

• Confusing subscriptions with management groups
• Thinking subscriptions organize management groups
• Assuming subscriptions apply policies directly

2. Which of the following is the correct way to create a management group using Azure CLI?

easy

A. az mg create --name MyGroup

B. az management-group create --group-name MyGroup

C. az account management-group create --name MyGroup

D. az group create --management MyGroup

Solution

1. Step 1: Identify the correct Azure CLI command

   The command to create a management group is 'az account management-group create' with the --name parameter.

2. Step 2: Check the options for syntax correctness

   az account management-group create --name MyGroup matches the correct syntax; others use incorrect commands or parameters.

3. Final Answer:

   az account management-group create --name MyGroup -> Option C

4. Quick Check:

   Correct CLI command = az account management-group create --name MyGroup [OK]

Hint: Use 'az account management-group create' to create groups [OK]

Common Mistakes:

• Using 'az group create' which creates resource groups, not management groups
• Incorrect parameter names like --group-name
• Shortened commands like 'az mg create' which don't exist

3. Given the following hierarchy: Management Group A contains Subscription X and Subscription Y. A policy is assigned at Management Group A. What is the effect on Subscription X and Y?

medium

A. Only Subscription X is affected by the policy

B. Both Subscription X and Y inherit the policy

C. Only Subscription Y is affected by the policy

D. Neither subscription is affected by the policy

Solution

1. Step 1: Understand policy inheritance in management groups

   Policies assigned at a management group apply to all child subscriptions automatically.

2. Step 2: Apply this to the given hierarchy

   Since both Subscription X and Y are under Management Group A, both inherit the policy.

3. Final Answer:

   Both Subscription X and Y inherit the policy -> Option B

4. Quick Check:

   Management group policies apply to all child subscriptions [OK]

Hint: Policies at management group apply to all child subscriptions [OK]

Common Mistakes:

• Thinking policies apply only to one subscription
• Assuming subscriptions override management group policies
• Believing policies do not inherit down the hierarchy

4. You tried to assign a subscription to a management group but received an error. Which of the following is a likely cause?

medium

A. Subscriptions can only be assigned via Azure Portal, not CLI

B. Management groups cannot contain subscriptions

C. You must create a resource group before assigning subscriptions

D. The subscription is already assigned to another management group

Solution

1. Step 1: Recall subscription assignment rules

   Each subscription can belong to only one management group at a time.

2. Step 2: Analyze the error cause

   If the subscription is already assigned elsewhere, reassigning without removal causes an error.

3. Final Answer:

   The subscription is already assigned to another management group -> Option D

4. Quick Check:

   One subscription per management group at a time [OK]

Hint: Check if subscription is already assigned before reassigning [OK]

Common Mistakes:

• Thinking management groups cannot contain subscriptions
• Believing resource groups are needed before assignment
• Assuming CLI cannot assign subscriptions

5. You have three subscriptions: S1, S2, and S3. You want to apply a security policy to S1 and S2 but not S3. How can you organize management groups to achieve this?

hard

A. Create a management group with S1 and S2 as children, assign the policy there; leave S3 outside

B. Assign the policy directly to S1 and S2 subscriptions individually

C. Put all three subscriptions in one management group and exclude S3 from the policy assignment

D. Create separate management groups for each subscription and assign the policy to S1 and S2 groups

Solution

1. Step 1: Understand management group hierarchy for policy scope

   Policies assigned to a management group apply to all its child subscriptions.

2. Step 2: Organize subscriptions to control policy application

   By placing S1 and S2 in a management group and assigning the policy there, S3 remains unaffected if outside that group.

3. Final Answer:

   Create a management group with S1 and S2 as children, assign the policy there; leave S3 outside -> Option A

4. Quick Check:

   Group subscriptions to control policy scope [OK]

Hint: Group only targeted subscriptions to apply policies selectively [OK]

Common Mistakes:

• Assigning policy to all subscriptions and trying to exclude one
• Assigning policies individually instead of using groups
• Putting all subscriptions in one group and expecting selective policy