Subscriptions and management groups in Azure - Step-by-Step Execution

Process Flow - Subscriptions and management groups

Start: Create Management Groups

↓

Assign Subscriptions to Groups

↓

Apply Policies and Access Controls

↓

Inheritance of Settings

↓

Manage Billing and Resources

↓

End

This flow shows how management groups organize subscriptions, apply policies, and manage access and billing.

Execution Sample

Azure

Create MG 'Corp'
Assign Sub1 to 'Corp'
Assign Sub2 to 'Corp'
Apply Policy to 'Corp'
Check Sub1 Policy
Check Sub2 Policy

This example creates a management group, assigns two subscriptions, applies a policy, and checks policy inheritance.

Process Table

Step	Action	Target	Result	Notes
1	Create Management Group	Corp	Management group 'Corp' created	Ready to organize subscriptions
2	Assign Subscription	Sub1 to Corp	Sub1 assigned to 'Corp'	Sub1 inherits Corp policies
3	Assign Subscription	Sub2 to Corp	Sub2 assigned to 'Corp'	Sub2 inherits Corp policies
4	Apply Policy	Corp	Policy applied to 'Corp'	Policy affects all child subscriptions
5	Check Policy	Sub1	Sub1 has policy from 'Corp'	Inheritance confirmed
6	Check Policy	Sub2	Sub2 has policy from 'Corp'	Inheritance confirmed
7	End	-	Execution complete	All subscriptions managed under 'Corp'

💡 All subscriptions assigned and policies applied via management group

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6	Final
Management Groups	{}	{'Corp': {}}	{'Corp': {'Sub1'}}	{'Corp': {'Sub1', 'Sub2'}}	{'Corp': {'Sub1', 'Sub2'}, 'Policy': 'Applied'}	{'Corp': {'Sub1', 'Sub2'}, 'Policy': 'Applied'}	{'Corp': {'Sub1', 'Sub2'}, 'Policy': 'Applied'}	{'Corp': {'Sub1', 'Sub2'}, 'Policy': 'Applied'}
Subscriptions	{}	{}	{'Sub1': 'Corp'}	{'Sub1': 'Corp', 'Sub2': 'Corp'}	{'Sub1': 'Corp', 'Sub2': 'Corp'}	{'Sub1': 'Corp', 'Sub2': 'Corp'}	{'Sub1': 'Corp', 'Sub2': 'Corp'}	{'Sub1': 'Corp', 'Sub2': 'Corp'}
Policies	None	None	None	None	Policy on 'Corp'	Policy on 'Corp'	Policy on 'Corp'	Policy on 'Corp'

Key Moments - 3 Insights

Why do subscriptions inherit policies from management groups?

Because policies applied to a management group automatically apply to all subscriptions assigned to it, as shown in steps 4 to 6 in the execution table.

Can a subscription belong to more than one management group?

No, each subscription can only be assigned to one management group at a time, as shown in steps 2 and 3 where Sub1 and Sub2 are assigned individually.

What happens if a policy is applied directly to a subscription and also to its management group?

The subscription will have both policies applied, but management group policies provide a baseline that applies to all child subscriptions, ensuring consistent governance.

Visual Quiz - 3 Questions

Look at the execution table, at which step is the policy first applied to the management group?

A Step 2

B Step 4

C Step 5

D Step 6

💡 Hint

Check the 'Action' column for when 'Apply Policy' occurs.

According to the variable tracker, what is the state of 'Subscriptions' after Step 3?

A {'Sub1': 'Corp', 'Sub2': 'Corp'}

B {'Sub1': 'Corp'}

C {}

D {'Sub2': 'Corp'}

💡 Hint

Look at the 'Subscriptions' row under 'After Step 3' in the variable tracker.

If a new subscription Sub3 is assigned to 'Corp' after Step 6, what will happen to its policies?

A Sub3 will have a different policy

B Sub3 will not have any policies

C Sub3 will inherit the policy applied to 'Corp'

D Sub3 must be assigned a policy manually

💡 Hint

Refer to the concept that policies on management groups apply to all assigned subscriptions.

Concept Snapshot

Subscriptions and Management Groups in Azure:
- Management groups organize subscriptions hierarchically.
- Policies and access controls applied to groups affect all child subscriptions.
- Each subscription belongs to one management group.
- This structure helps manage governance and billing efficiently.
- Changes at group level propagate automatically to subscriptions.

Full Transcript

This visual execution shows how Azure management groups organize subscriptions. First, a management group named 'Corp' is created. Then, two subscriptions, Sub1 and Sub2, are assigned to 'Corp'. A policy is applied to the 'Corp' group, which automatically applies to both subscriptions. The variable tracker confirms the state changes after each step, showing subscriptions assigned and policies applied. Key moments clarify inheritance of policies and subscription assignment rules. The quiz tests understanding of when policies apply and how subscriptions relate to management groups.

Practice

1. What is the main purpose of an Azure subscription?

easy

A. To group cloud resources for billing and access control

B. To organize management groups in a hierarchy

C. To apply policies across multiple tenants

D. To create virtual networks automatically

Solution

1. Step 1: Understand the role of subscriptions

   Subscriptions in Azure are containers that group resources for billing and access control.

2. Step 2: Differentiate from management groups

   Management groups organize subscriptions, not the other way around.

3. Final Answer:

   To group cloud resources for billing and access control -> Option A

4. Quick Check:

   Subscription = billing and access grouping [OK]

Hint: Subscriptions group resources for billing and access [OK]

Common Mistakes:

• Confusing subscriptions with management groups
• Thinking subscriptions organize management groups
• Assuming subscriptions apply policies directly

2. Which of the following is the correct way to create a management group using Azure CLI?

easy

A. az mg create --name MyGroup

B. az management-group create --group-name MyGroup

C. az account management-group create --name MyGroup

D. az group create --management MyGroup

Solution

1. Step 1: Identify the correct Azure CLI command

   The command to create a management group is 'az account management-group create' with the --name parameter.

2. Step 2: Check the options for syntax correctness

   az account management-group create --name MyGroup matches the correct syntax; others use incorrect commands or parameters.

3. Final Answer:

   az account management-group create --name MyGroup -> Option C

4. Quick Check:

   Correct CLI command = az account management-group create --name MyGroup [OK]

Hint: Use 'az account management-group create' to create groups [OK]

Common Mistakes:

• Using 'az group create' which creates resource groups, not management groups
• Incorrect parameter names like --group-name
• Shortened commands like 'az mg create' which don't exist

3. Given the following hierarchy: Management Group A contains Subscription X and Subscription Y. A policy is assigned at Management Group A. What is the effect on Subscription X and Y?

medium

A. Only Subscription X is affected by the policy

B. Both Subscription X and Y inherit the policy

C. Only Subscription Y is affected by the policy

D. Neither subscription is affected by the policy

Solution

1. Step 1: Understand policy inheritance in management groups

   Policies assigned at a management group apply to all child subscriptions automatically.

2. Step 2: Apply this to the given hierarchy

   Since both Subscription X and Y are under Management Group A, both inherit the policy.

3. Final Answer:

   Both Subscription X and Y inherit the policy -> Option B

4. Quick Check:

   Management group policies apply to all child subscriptions [OK]

Hint: Policies at management group apply to all child subscriptions [OK]

Common Mistakes:

• Thinking policies apply only to one subscription
• Assuming subscriptions override management group policies
• Believing policies do not inherit down the hierarchy

4. You tried to assign a subscription to a management group but received an error. Which of the following is a likely cause?

medium

A. Subscriptions can only be assigned via Azure Portal, not CLI

B. Management groups cannot contain subscriptions

C. You must create a resource group before assigning subscriptions

D. The subscription is already assigned to another management group

Solution

1. Step 1: Recall subscription assignment rules

   Each subscription can belong to only one management group at a time.

2. Step 2: Analyze the error cause

   If the subscription is already assigned elsewhere, reassigning without removal causes an error.

3. Final Answer:

   The subscription is already assigned to another management group -> Option D

4. Quick Check:

   One subscription per management group at a time [OK]

Hint: Check if subscription is already assigned before reassigning [OK]

Common Mistakes:

• Thinking management groups cannot contain subscriptions
• Believing resource groups are needed before assignment
• Assuming CLI cannot assign subscriptions

5. You have three subscriptions: S1, S2, and S3. You want to apply a security policy to S1 and S2 but not S3. How can you organize management groups to achieve this?

hard

A. Create a management group with S1 and S2 as children, assign the policy there; leave S3 outside

B. Assign the policy directly to S1 and S2 subscriptions individually

C. Put all three subscriptions in one management group and exclude S3 from the policy assignment

D. Create separate management groups for each subscription and assign the policy to S1 and S2 groups

Solution

1. Step 1: Understand management group hierarchy for policy scope

   Policies assigned to a management group apply to all its child subscriptions.

2. Step 2: Organize subscriptions to control policy application

   By placing S1 and S2 in a management group and assigning the policy there, S3 remains unaffected if outside that group.

3. Final Answer:

   Create a management group with S1 and S2 as children, assign the policy there; leave S3 outside -> Option A

4. Quick Check:

   Group subscriptions to control policy scope [OK]

Hint: Group only targeted subscriptions to apply policies selectively [OK]

Common Mistakes:

• Assigning policy to all subscriptions and trying to exclude one
• Assigning policies individually instead of using groups
• Putting all subscriptions in one group and expecting selective policy