Subscriptions and management groups in Azure - Deep Dive

Overview - Subscriptions and management groups

What is it?

Subscriptions and management groups are ways to organize and control access to resources in Azure. A subscription is like a container that holds resources such as virtual machines and databases. Management groups are higher-level containers that group multiple subscriptions together for easier management and policy enforcement. They help keep large cloud environments organized and secure.

Why it matters

Without subscriptions and management groups, managing many resources and teams in Azure would be chaotic and risky. You would struggle to control who can do what, and it would be hard to apply rules consistently. These tools solve the problem of scale and security by providing clear boundaries and centralized control. This means better cost tracking, security, and compliance for businesses.

Where it fits

Before learning this, you should understand basic cloud concepts like resources and accounts. After this, you can learn about Azure role-based access control (RBAC), policies, and cost management. This topic is a foundation for managing large Azure environments effectively.

Mental Model

Core Idea

Subscriptions are containers for resources, and management groups are containers for subscriptions, creating a hierarchy to organize and control Azure resources at scale.

Think of it like...

Think of subscriptions as individual apartments where people live, and management groups as apartment buildings that hold many apartments. Managing rules and access at the building level is easier than doing it for each apartment separately.

Azure Hierarchy:

┌─────────────────────────────┐
│      Management Group       │
│  ┌───────────────┐          │
│  │ Subscription 1│          │
│  └───────────────┘          │
│  ┌───────────────┐          │
│  │ Subscription 2│          │
│  └───────────────┘          │
└─────────────────────────────┘

Each subscription contains resources like VMs, databases, and networks.

Build-Up - 6 Steps

1

Foundation

Understanding Azure Subscriptions

Concept: Learn what an Azure subscription is and its role as a resource container.

An Azure subscription is like a billing and management container. It holds all your Azure resources such as virtual machines, storage accounts, and databases. Each subscription has its own billing and access control settings. You can think of it as your personal cloud space where you create and manage resources.

Result

You understand that subscriptions group resources and define billing boundaries.

Knowing that subscriptions are the basic unit of resource grouping helps you organize and track cloud usage effectively.

2

Foundation

What Are Management Groups?

Concept: Introduce management groups as a way to organize multiple subscriptions.

Management groups sit above subscriptions in Azure's hierarchy. They let you group subscriptions together to apply policies and access controls at a higher level. For example, you can create a management group for all subscriptions used by your finance team. This way, you manage rules once for all those subscriptions instead of individually.

Result

You see how management groups simplify managing many subscriptions.

Understanding management groups helps you scale governance and security across large Azure environments.

3

Intermediate

Hierarchy and Policy Inheritance

🤔Before reading on: Do you think policies set on management groups apply to all subscriptions inside them? Commit to your answer.

Concept: Learn how policies and access controls flow down the hierarchy from management groups to subscriptions and resources.

Policies and role assignments set on a management group automatically apply to all subscriptions and resources inside it. This inheritance means you can enforce rules like security standards or cost limits centrally. If you set a policy to block certain resource types at the management group level, no subscription inside can create those resources.

Result

You understand that management groups control policies and permissions for all nested subscriptions.

Knowing policy inheritance prevents mistakes where rules are inconsistently applied across subscriptions.

4

Intermediate

Subscription Limits and Management Group Scope

🤔Before reading on: Can a subscription belong to multiple management groups at once? Commit to your answer.

Concept: Understand the limits on subscriptions and how management groups define scope boundaries.

Each subscription can belong to only one management group at a time, but management groups can have many subscriptions. Azure allows up to six levels of management groups above subscriptions. This structure helps keep your cloud organized but also means you must plan your hierarchy carefully to avoid complexity.

Result

You know the structural limits and how to plan your Azure organization.

Understanding these limits helps you design a clear and manageable cloud governance model.

5

Advanced

Using Management Groups for Cost and Security

🤔Before reading on: Do you think management groups can help track costs across subscriptions? Commit to your answer.

Concept: Explore how management groups help with cost management and security compliance.

Management groups allow you to group subscriptions by department, project, or environment. This grouping helps track costs centrally and apply security policies consistently. For example, you can block risky resource types or enforce encryption policies across all subscriptions in a management group. This reduces manual work and errors.

Result

You see how management groups improve financial and security oversight.

Knowing this helps you leverage management groups to reduce cloud waste and security risks.

6

Expert

Complex Hierarchies and Policy Conflicts

🤔Before reading on: What happens if two policies conflict at different management group levels? Commit to your answer.

Concept: Understand how Azure resolves policy conflicts in deep management group hierarchies.

When multiple policies apply from different management group levels, Azure evaluates all and enforces the strictest rules. If one policy allows a resource and another blocks it, the block wins. This behavior ensures security but can cause unexpected denials if not planned carefully. Experts design hierarchies and policies to avoid conflicts and confusion.

Result

You grasp how policy conflicts are resolved and why careful planning is critical.

Understanding conflict resolution prevents costly mistakes and downtime in production environments.

Under the Hood

Azure organizes resources in a tree-like hierarchy where management groups are nodes above subscriptions. Policies and role assignments propagate down this tree. When a user requests an action, Azure checks permissions and policies starting from the resource up through subscription and management group levels. This layered check ensures consistent enforcement of rules and access control.

Why designed this way?

This design allows centralized governance at scale. Early Azure versions managed resources only at subscription level, which became hard to maintain for large organizations. Management groups were introduced to provide a scalable, hierarchical model that supports enterprise needs for compliance, security, and cost control.

Azure Resource Hierarchy:

┌─────────────────────────────┐
│      Management Group       │
│  ┌───────────────┐          │
│  │ Subscription 1│          │
│  │  ┌─────────┐  │          │
│  │  │Resource │  │          │
│  │  └─────────┘  │          │
│  └───────────────┘          │
│  ┌───────────────┐          │
│  │ Subscription 2│          │
│  └───────────────┘          │
└─────────────────────────────┘

Policy and access checks flow down and up this tree.

Myth Busters - 4 Common Misconceptions

Quick: Can a subscription belong to multiple management groups at the same time? Commit to yes or no.

Common Belief: A subscription can be part of many management groups simultaneously for flexible organization.

Reality: Each subscription can belong to only one management group at a time.

Why it matters: Trying to assign a subscription to multiple groups causes confusion and breaks policy inheritance, leading to governance gaps.

Quick: Do policies set on subscriptions override those on management groups? Commit to yes or no.

Common Belief: Policies on subscriptions override management group policies because they are closer to the resources.

Reality: Policies from management groups and subscriptions combine, and the strictest policy applies.

Why it matters: Misunderstanding this can cause unexpected resource denials or security holes.

Quick: Does creating many management groups always improve cloud management? Commit to yes or no.

Common Belief: More management groups always mean better organization and control.

Reality: Too many management groups create complexity and confusion, making management harder.

Why it matters: Overcomplicating the hierarchy can lead to mistakes and slow down operations.

Quick: Can management groups be used to directly deploy resources? Commit to yes or no.

Common Belief: You can deploy resources directly into management groups.

Reality: Resources can only be deployed inside subscriptions, not management groups.

Why it matters: Trying to deploy to management groups causes deployment failures and wasted effort.

Expert Zone

1

Management groups support up to six levels of hierarchy, but deeper nesting can cause policy evaluation delays and complexity.

2

Role assignments at management group level cascade down but can be overridden by deny assignments at subscription or resource level.

3

Azure locks and resource locks interact with management group policies, requiring careful coordination to avoid conflicts.

When NOT to use

Avoid using management groups for very small environments with few subscriptions; simpler subscription-level management suffices. For fine-grained access control, combine management groups with Azure RBAC and resource groups. Use Azure Policy for compliance enforcement instead of relying solely on management groups.

Production Patterns

Enterprises create management groups by department, environment (dev/test/prod), or geography to centralize policy and cost management. They use automation scripts to assign subscriptions to groups and apply policies consistently. Monitoring tools track policy compliance across the hierarchy to prevent drift.

Connections

Role-Based Access Control (RBAC)

Builds-on

Understanding management groups helps grasp how RBAC permissions can be assigned at different levels for scalable access control.

Organizational Hierarchies in Business

Same pattern

Management groups mirror company structures, showing how hierarchical organization simplifies governance and responsibility.

File System Directories

Similar structure

Like folders containing files and subfolders, management groups contain subscriptions and resources, helping visualize inheritance and containment.

Common Pitfalls

#1 Trying to deploy resources directly into a management group.

Wrong approach:

az deployment group create --management-group-id mg1 --template-file template.json

Correct approach:

az deployment group create --subscription sub1 --resource-group rg1 --template-file template.json

Root cause:

Misunderstanding that resources must be deployed inside subscriptions and resource groups, not management groups.

#2 Assigning a subscription to multiple management groups.

Wrong approach:

Assign subscription 'sub1' to management group 'mg1' and also to 'mg2' simultaneously.

Correct approach:

Assign subscription 'sub1' to only one management group at a time, e.g., 'mg1'.

Root cause:

Believing subscriptions can belong to multiple management groups for flexibility, which Azure does not allow.

#3 Setting conflicting policies without planning hierarchy.

Wrong approach:

Apply a policy allowing resource type A at subscription level and a blocking policy for the same resource at management group level without coordination.

Correct approach:

Plan policies so that higher-level management group policies do not conflict with subscription-level policies.

Root cause:

Not understanding how Azure enforces the strictest policy in case of conflicts.

Key Takeaways

Azure subscriptions are containers for resources and define billing and access boundaries.

Management groups organize subscriptions into a hierarchy for centralized policy and access management.

Policies and permissions set at management group level inherit down to subscriptions and resources, enforcing consistent governance.

Each subscription can belong to only one management group, and careful planning of the hierarchy prevents conflicts and complexity.

Understanding this hierarchy is essential for managing large Azure environments securely and efficiently.

Practice

1. What is the main purpose of an Azure subscription?

easy

A. To group cloud resources for billing and access control

B. To organize management groups in a hierarchy

C. To apply policies across multiple tenants

D. To create virtual networks automatically

Solution

1. Step 1: Understand the role of subscriptions

   Subscriptions in Azure are containers that group resources for billing and access control.

2. Step 2: Differentiate from management groups

   Management groups organize subscriptions, not the other way around.

3. Final Answer:

   To group cloud resources for billing and access control -> Option A

4. Quick Check:

   Subscription = billing and access grouping [OK]

Hint: Subscriptions group resources for billing and access [OK]

Common Mistakes:

• Confusing subscriptions with management groups
• Thinking subscriptions organize management groups
• Assuming subscriptions apply policies directly

2. Which of the following is the correct way to create a management group using Azure CLI?

easy

A. az mg create --name MyGroup

B. az management-group create --group-name MyGroup

C. az account management-group create --name MyGroup

D. az group create --management MyGroup

Solution

1. Step 1: Identify the correct Azure CLI command

   The command to create a management group is 'az account management-group create' with the --name parameter.

2. Step 2: Check the options for syntax correctness

   az account management-group create --name MyGroup matches the correct syntax; others use incorrect commands or parameters.

3. Final Answer:

   az account management-group create --name MyGroup -> Option C

4. Quick Check:

   Correct CLI command = az account management-group create --name MyGroup [OK]

Hint: Use 'az account management-group create' to create groups [OK]

Common Mistakes:

• Using 'az group create' which creates resource groups, not management groups
• Incorrect parameter names like --group-name
• Shortened commands like 'az mg create' which don't exist

3. Given the following hierarchy: Management Group A contains Subscription X and Subscription Y. A policy is assigned at Management Group A. What is the effect on Subscription X and Y?

medium

A. Only Subscription X is affected by the policy

B. Both Subscription X and Y inherit the policy

C. Only Subscription Y is affected by the policy

D. Neither subscription is affected by the policy

Solution

1. Step 1: Understand policy inheritance in management groups

   Policies assigned at a management group apply to all child subscriptions automatically.

2. Step 2: Apply this to the given hierarchy

   Since both Subscription X and Y are under Management Group A, both inherit the policy.

3. Final Answer:

   Both Subscription X and Y inherit the policy -> Option B

4. Quick Check:

   Management group policies apply to all child subscriptions [OK]

Hint: Policies at management group apply to all child subscriptions [OK]

Common Mistakes:

• Thinking policies apply only to one subscription
• Assuming subscriptions override management group policies
• Believing policies do not inherit down the hierarchy

4. You tried to assign a subscription to a management group but received an error. Which of the following is a likely cause?

medium

A. Subscriptions can only be assigned via Azure Portal, not CLI

B. Management groups cannot contain subscriptions

C. You must create a resource group before assigning subscriptions

D. The subscription is already assigned to another management group

Solution

1. Step 1: Recall subscription assignment rules

   Each subscription can belong to only one management group at a time.

2. Step 2: Analyze the error cause

   If the subscription is already assigned elsewhere, reassigning without removal causes an error.

3. Final Answer:

   The subscription is already assigned to another management group -> Option D

4. Quick Check:

   One subscription per management group at a time [OK]

Hint: Check if subscription is already assigned before reassigning [OK]

Common Mistakes:

• Thinking management groups cannot contain subscriptions
• Believing resource groups are needed before assignment
• Assuming CLI cannot assign subscriptions

5. You have three subscriptions: S1, S2, and S3. You want to apply a security policy to S1 and S2 but not S3. How can you organize management groups to achieve this?

hard

A. Create a management group with S1 and S2 as children, assign the policy there; leave S3 outside

B. Assign the policy directly to S1 and S2 subscriptions individually

C. Put all three subscriptions in one management group and exclude S3 from the policy assignment

D. Create separate management groups for each subscription and assign the policy to S1 and S2 groups

Solution

1. Step 1: Understand management group hierarchy for policy scope

   Policies assigned to a management group apply to all its child subscriptions.

2. Step 2: Organize subscriptions to control policy application

   By placing S1 and S2 in a management group and assigning the policy there, S3 remains unaffected if outside that group.

3. Final Answer:

   Create a management group with S1 and S2 as children, assign the policy there; leave S3 outside -> Option A

4. Quick Check:

   Group subscriptions to control policy scope [OK]

Hint: Group only targeted subscriptions to apply policies selectively [OK]

Common Mistakes:

• Assigning policy to all subscriptions and trying to exclude one
• Assigning policies individually instead of using groups
• Putting all subscriptions in one group and expecting selective policy