Management Groups: A Comprehensive Guide
Management Groups: A Comprehensive Guide
Why are Management Groups Important?Management Groups provide a hierarchical container above subscriptions, enabling you to efficiently manage access, policies, and compliance across multiple Azure subscriptions. They are crucial for organizations with many subscriptions requiring consistent governance.
What are Management Groups?Management Groups are containers that help you manage access, policy, and compliance for multiple subscriptions. All Azure subscriptions are members of a management group hierarchy. They enable you to apply governance conditions at scale.
Key characteristics:
* Hierarchical organization of Azure subscriptions.
* A single management group hierarchy supports a directory.
* Each directory is given a single top-level management group called the 'Root' management group.
* Management groups can support up to six levels of depth (Root + 5 levels). Each management group and subscription can only belong to one management group.
* Permissions applied at a higher level are inherited by the lower levels.
How Management Groups WorkManagement Groups create a hierarchy allowing you to apply policies and access controls that are inherited by all subscriptions within that management group. Subscriptions inherit the conditions applied to the management group. This ensures consistency and saves time compared to applying the same policies individually to each subscription.
Key actions:
1. Create a Management Group hierarchy within your Azure Active Directory tenant. Start with a Root group and decide your hierarchy.
2. Move Azure subscriptions into appropriate Management Groups.
3. Assign Azure Policies to Management Groups. These policies are inherited by all subscriptions within the Management Group.
4. Assign RBAC roles to Management Groups. These roles are inherited by all subscriptions within the Management Group.
Example ScenarioImagine you have Development, Testing, and Production environments, each represented by multiple subscriptions. You can create Management Groups for each: 'Development,' 'Testing,' and 'Production.' Then you can apply specific policies.
* 'Development': Policies allowing cost-saving measures (e.g., smaller VM sizes).
* 'Production': Policies that enforce high availability and strong security.
How to answer questions regarding Management Groups in an exam?When answering questions on Management Groups in the AZ-900 or other Azure exams, focus on these key concepts:
* Understand the hierarchy and its purpose.
* Recognize policy inheritance. Be aware of which policies are inherited from which level.
* Distinguish between Management Groups and Resource Groups. Management Groups are for managing subscriptions, while Resource Groups are for managing resources within a subscription.
Exam Tips: Answering Questions on Management Groups *
Read the Question Carefully: Identify what the question is asking. For example, is it about organizing subscriptions, applying policies, or role-based access control (RBAC)?
*
Focus on Scale: Management Groups are specifically important to manage *many* subscriptions at scale. If the question mentions a small number of subscriptions, other tools such as Azure Policy or Azure Blueprints deployed individually at the subscription scope may be more appropriate.
*
Understand Inheritance: Policies and roles applied to a Management Group are inherited unless overridden at a lower level. Ensure you grasp how inheritance works.
*
Root Management Group: Be aware of the Root Management Group. Every Azure AD tenant has one Root Management Group to which all other Management Groups are attached to.
*
Understand the Depth Limitations: Although the hierarchy is very flexible, there are limitations to how many nested levels there can be. There is also a limitation of how many Management Groups an Azure tenant can have. Make sure to understand and recognize these limits.
By understanding these concepts and tips, you'll be well-prepared to answer Management Group-related questions on the exam.