The effects of enabling Management Groups

Question

Hi

I have multiple subscriptions in my Azure tenant. I have not used Management Groups so far. I wan't to enable Management Groups right now by going to the Management Groups page and clicking on the "Start using Management Groups" button.. I am curious what effects this can have on my subscriptions and resources. If I don't define anything in the Management Group -as a start- can it mess up anything in my subscriptions? Or just because the management group option is enabled it won't have any effect on anything until I actually start to define policies and such on Management Group level.

Thanks

Answer 1

@Sándor Tőkési Management Group is a container that holds subscription for ease of governance. You can efficiently manage policies, access and compliance for the subscriptions in the management group.

When any user starts using management groups, there's an initial setup process that happens. The first step is the root management group is created in the directory. Once this group is created, all existing subscriptions that exist in the directory are made children of the root management group. The reason for this process is to make sure there's only one management group hierarchy within a directory. The single hierarchy within the directory allows administrative customers to apply global access and policies that other customers within the directory can't bypass. Anything assigned on the root will apply to the entire hierarchy, which includes all management groups, subscriptions, resource groups, and resources within that Azure AD Tenant.

In short, its a container which holds your subscriptions and it doesn't have any effect for subscriptions unless you define policies or manage access at management group scope.

References :

• https://learn.microsoft.com/en-us/azure/governance/management-groups/overview
• https://learn.microsoft.com/en-us/azure/governance/azure-management