How to work with your management groups – Azure Governance – Azure governance

Table of Contents0.1 In this article1 Change the name of a management group1.1 Change the name in the portal1.2 Change the name in PowerShell1.3 Change the name in Azure CLI2 Delete a management group2.1 Delete in the portal2.2 Delete in PowerShell2.3 Delete in Azure CLI3 View management groups3.1 View in […]


If your organization has many subscriptions, you may need a way to efficiently manage access,
policies, and compliance for those subscriptions. Azure management groups provide a level of scope
above subscriptions. You organize subscriptions into containers called “management groups” and apply
your governance conditions to the management groups. All subscriptions within a management group
automatically inherit the conditions applied to the management group.

Management groups give you enterprise-grade management at a large scale no matter what type of
subscriptions you might have. To learn more about management groups, see
Organize your resources with Azure management groups.

Important

Azure Resource Manager user tokens and management group cache lasts for 30 minutes before they are
forced to refresh. After doing any action like moving a management group or subscription, it might
take up to 30 minutes to show. To see the updates sooner you need to update your token by
refreshing the browser, signing in and out, or requesting a new token.

Change the name of a management group

You can change the name of the management group by using the portal, PowerShell, or Azure CLI.

Change the name in the portal

  1. Log into the Azure portal.

  2. Select All services > Management groups.

  3. Select the management group you would like to rename.

  4. Select details.

  5. Select the Rename group option at the top of the page.

    Screenshot of the action bar and the 'Rename Group' button on the management group page.

  6. When the menu opens, enter the new name you would like to have displayed.

    Screenshot of the Rename Group window and options to rename a management group.

  7. Select Save.

Change the name in PowerShell

To update the display name use Update-AzManagementGroup. For example, to change a management
groups display name from “Contoso IT” to “Contoso Group”, you run the following command:

Update-AzManagementGroup -GroupName 'ContosoIt' -DisplayName 'Contoso Group'

Change the name in Azure CLI

For Azure CLI, use the update command.

az account management-group update --name 'Contoso' --display-name 'Contoso Group'

Delete a management group

To delete a management group, the following requirements must be met:

  1. There are no child management groups or subscriptions under the management group. To move a
    subscription or management group to another management group, see
    Moving management groups and subscriptions in the hierarchy.

  2. You need write permissions on the management group (“Owner”, “Contributor”, or “Management Group
    Contributor”). To see what permissions you have, select the management group and then select
    IAM. To learn more on Azure roles, see
    Azure role-based access control (Azure RBAC).

Delete in the portal

  1. Log into the Azure portal.

  2. Select All services > Management groups.

  3. Select the management group you would like to delete.

  4. Select details.

  5. Select Delete

    Screenshot of the Management group page with the 'Delete' button highlighted.

    Tip

    If the icon is disabled, hovering your mouse selector over the icon shows you the reason.

  6. There’s a window that opens confirming you want to delete the management group.

    Screenshot of the 'Delete group' confirmation dialog for deleting a management group.

  7. Select Yes.

Delete in PowerShell

Use the Remove-AzManagementGroup command within PowerShell to delete management groups.

Remove-AzManagementGroup -GroupName 'Contoso'

Delete in Azure CLI

With Azure CLI, use the command az account management-group delete.

az account management-group delete --name 'Contoso'

View management groups

You can view any management group you have a direct or inherited Azure role on.

View in the portal

  1. Log into the Azure portal.

  2. Select All services > Management groups.

  3. The management group hierarchy page will load. This page is where you can explore all the
    management groups and subscriptions you have access to. Selecting the group name takes you to a
    lower level in the hierarchy. The navigation works the same as a file explorer does.

  4. To see the details of the management group, select the (details) link next to the title of
    the management group. If this link isn’t available, you don’t have permissions to view that
    management group.

    Screenshot of the Management groups page showing child management groups and subscriptions.

View in PowerShell

You use the Get-AzManagementGroup command to retrieve all groups. See
Az.Resources modules for the full list of
management group GET PowerShell commands.

Get-AzManagementGroup

For a single management group’s information, use the -GroupName parameter

Get-AzManagementGroup -GroupName 'Contoso'

To return a specific management group and all the levels of the hierarchy under it, use -Expand
and -Recurse parameters.

PS C:> $response = Get-AzManagementGroup -GroupName TestGroupParent -Expand -Recurse
PS C:> $response

Id                : /providers/Microsoft.Management/managementGroups/TestGroupParent
Type              : /providers/Microsoft.Management/managementGroups
Name              : TestGroupParent
TenantId          : 00000000-0000-0000-0000-000000000000
DisplayName       : TestGroupParent
UpdatedTime       : 2/1/2018 11:15:46 AM
UpdatedBy         : 00000000-0000-0000-0000-000000000000
ParentId          : /providers/Microsoft.Management/managementGroups/00000000-0000-0000-0000-000000000000
ParentName        : 00000000-0000-0000-0000-000000000000
ParentDisplayName : 00000000-0000-0000-0000-000000000000
Children          : {TestGroup1DisplayName, TestGroup2DisplayName}

PS C:> $response.Children[0]

Type        : /managementGroup
Id          : /providers/Microsoft.Management/managementGroups/TestGroup1
Name        : TestGroup1
DisplayName : TestGroup1DisplayName
Children    : {TestRecurseChild}

PS C:> $response.Children[0].Children[0]

Type        : /managementGroup
Id          : /providers/Microsoft.Management/managementGroups/TestRecurseChild
Name        : TestRecurseChild
DisplayName : TestRecurseChild
Children    :

View in Azure CLI

You use the list command to retrieve all groups.

az account management-group list

For a single management group’s information, use the show command

az account management-group show --name 'Contoso'

To return a specific management group and all the levels of the hierarchy under it, use -Expand
and -Recurse parameters.

az account management-group show --name 'Contoso' -e -r

Moving management groups and subscriptions

One reason to create a management group is to bundle subscriptions together. Only management groups
and subscriptions can be made children of another management group. A subscription that moves to a
management group inherits all user access and policies from the parent management group

When moving a management group or subscription to be a child of another management group, three
rules need to be evaluated as true.

If you’re doing the move action, you need:

  • Management group write and Role Assignment write permissions on the child subscription or
    management group.

    • Built-in role example Owner
  • Management group write access on the target parent management group.
    • Built-in role example: Owner, Contributor, Management Group Contributor
  • Management group write access on the existing parent management group.
    • Built-in role example: Owner, Contributor, Management Group Contributor

Exception: If the target or the existing parent management group is the Root management group,
the permissions requirements don’t apply. Since the Root management group is the default landing
spot for all new management groups and subscriptions, you don’t need permissions on it to move an
item.

If the Owner role on the subscription is inherited from the current management group, your move
targets are limited. You can only move the subscription to another management group where you have
the Owner role. You can’t move the subscription to a management group where you’re only a
contributor because you would lose ownership of the subscription. If you’re directly assigned to the
Owner role for the subscription, you can move it to any management group where you’re a contributor.

To see what permissions you have in the Azure portal, select the management group and then select
IAM. To learn more on Azure roles, see
Azure role-based access control (Azure RBAC).

Move subscriptions

Add an existing Subscription to a management group in the portal

  1. Log into the Azure portal.

  2. Select All services > Management groups.

  3. Select the management group you’re planning to be the parent.

  4. At the top of the page, select Add subscription.

  5. Select the subscription in the list with the correct ID.

    Screenshot of the 'Add subscription' options for selecting an existing subscription to add to a management group.

  6. Select “Save”.

Remove a subscription from a management group in the portal

  1. Log into the Azure portal.

  2. Select All services > Management groups.

  3. Select the management group you’re planning that is the current parent.

  4. Select the ellipse at the end of the row for the subscription in the list you want to move.

    Screenshot of the alternative menu for a subscription to select the 'Move' option.

  5. Select Move.

  6. On the menu that opens, select the Parent management group.

    Screenshot of the 'Move' window and options for moving a subscription to a different management group.

  7. Select Save.

Move subscriptions in PowerShell

To move a subscription in PowerShell, you use the New-AzManagementGroupSubscription command.

New-AzManagementGroupSubscription -GroupName 'Contoso' -SubscriptionId '12345678-1234-1234-1234-123456789012'

To remove the link between and subscription and the management group use the
Remove-AzManagementGroupSubscription command.

Remove-AzManagementGroupSubscription -GroupName 'Contoso' -SubscriptionId '12345678-1234-1234-1234-123456789012'

Move subscriptions in Azure CLI

To move a subscription in CLI, you use the add command.

az account management-group subscription add --name 'Contoso' --subscription '12345678-1234-1234-1234-123456789012'

To remove the subscription from the management group, use the subscription remove command.

az account management-group subscription remove --name 'Contoso' --subscription '12345678-1234-1234-1234-123456789012'

Move subscriptions in ARM template

To move a subscription in an Azure Resource Manager template (ARM template), use the following template.

{
    "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "targetMgId": {
            "type": "string",
            "metadata": {
                "description": "Provide the ID of the management group that you want to move the subscription to."
            }
        },
        "subscriptionId": {
            "type": "string",
            "metadata": {
                "description": "Provide the ID of the existing subscription to move."
            }
        }
    },
    "resources": [
        {
            "scope": "/", 
            "type": "Microsoft.Management/managementGroups/subscriptions",
            "apiVersion": "2020-05-01",
            "name": "[concat(parameters('targetMgId'), '/', parameters('subscriptionId'))]",
            "properties": {
            }
        }
    ],
    "outputs": {}
}

Move management groups

Move management groups in the portal

  1. Log into the Azure portal.

  2. Select All services > Management groups.

  3. Select the management group you’re planning to be the parent.

  4. At the top of the page, select Add management group.

  5. In the menu that opens, select if you want a new or use an existing management group.

    • Selecting new will create a new management group.
    • Selecting an existing will present you with a drop-down of all the management groups you can
      move to this management group.

    Screenshot of the 'Add management group' options for creating a new management group.

  6. Select Save.

Move management groups in PowerShell

Use the Update-AzManagementGroup command in PowerShell to move a management group under a different
group.

$parentGroup = Get-AzManagementGroup -GroupName ContosoIT
Update-AzManagementGroup -GroupName 'Contoso' -ParentId $parentGroup.id

Move management groups in Azure CLI

Use the update command to move a management group with Azure CLI.

az account management-group update --name 'Contoso' --parent ContosoIT

Audit management groups using activity logs

Management groups are supported within
Azure Activity Log. You can query all
events that happen to a management group in the same central location as other Azure resources. For
example, you can see all Role Assignments or Policy Assignment changes made to a particular
management group.

Screenshot of Activity Logs and operations related to the selected management group.

When looking to query on Management Groups outside of the Azure portal, the target scope for
management groups looks like “/providers/Microsoft.Management/managementGroups/{yourMgID}”.

Referencing management groups from other Resource Providers

When referencing management groups from other Resource Provider’s actions, use the following path as
the scope. This path is used when using PowerShell, Azure CLI, and REST APIs.

/providers/Microsoft.Management/managementGroups/{yourMgID}

An example of using this path is when assigning a new role assignment to a management group in
PowerShell:

New-AzRoleAssignment -Scope "/providers/Microsoft.Management/managementGroups/Contoso"

The same scope path is used when retrieving a policy definition at a management group.

GET https://management.azure.com/providers/Microsoft.Management/managementgroups/MyManagementGroup/providers/Microsoft.Authorization/policyDefinitions/ResourceNaming?api-version=2019-09-01

Next steps

To learn more about management groups, see:

Source Article

Next Post

Management operations overview - Azure SQL Managed Instance

Tue Apr 13 , 2021
Table of Contents0.1 In this article1 What are management operations?2 Duration3 Instance availability4 Management operations steps4.1 Managed instance deployment steps4.2 Managed instance update steps5 Management operations cross-impact6 Monitoring management operations7 Canceling management operations8 Next steps 07/10/2020 8 minutes to read In this article […]