Management Groups
😟 THE PROBLEM
50 subscriptions, and the same rule has to be set 50 times by hand.
😊 THE SOLUTION
Put subscriptions in management groups and assign the rule once.
- Repeating settings in every subscription✓ Assign once at the management group
- New subscriptions miss the rules✓ They inherit rules automatically
- No structure across teams✓ A tree that mirrors your governance
Quick answer
Management groups are containers that organise multiple subscriptions so you can apply governance, such as Azure Policy and role-based access control, once and have it inherited by every subscription, resource group and resource beneath them. They can be nested to mirror your organisation, under a single root management group.
Exam objective: 2.1.6 Describe management groups. (Skills measured as of July 20, 2026)
Start with a question
Your company has 50 subscriptions. How do you make sure none of them create resources outside Europe?
Setting the same rule 50 times is slow and error-prone, and someone will forget. Management groups let you set it once, at the top.
Explain it like I’m 10
The technical explanation
Management groups sit above subscriptions in the hierarchy. You can place subscriptions, and other management groups, inside them, building a tree that mirrors how you govern your organisation.
- Policies and RBAC assignments made at a management group are inherited by all child management groups, subscriptions, resource groups and resources.
- Every tenant has one root management group.
- Management groups can be nested up to six levels deep, excluding the root and subscription levels.
- Each management group and subscription has exactly one parent.
- A directory can have up to 10,000 management groups.
Real-world business scenario
A global retailer
- The problem
- Each of 60 subscriptions had different, inconsistent rules; some created resources in non-approved countries.
- What they used
- Created a management group hierarchy (Production, Non-production, Sandbox) and assigned an 'Allowed locations' policy at the root.
- Why that choice
- One assignment at the top is inherited by every subscription and resource.
- The result
- All subscriptions now follow the same location and tagging rules automatically.
When to use it and when not to
✓ Use it when…
- You have several subscriptions that need the same policies and access.
- You want governance that scales as new subscriptions are added.
✕ Think twice when…
- Building a deep hierarchy that mirrors every team. Keep it shallow and governance-driven.
Interview preparation
Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.
Beginner What is a management group?
Model answer
A container for subscriptions. If I apply a policy or permission to a management group, every subscription inside it gets that setting automatically.
Intermediate What are the key facts about management groups?
Model answer
They contain subscriptions or other management groups, can be nested up to six levels deep (not counting the root and subscription levels), each management group or subscription has only one parent, and a directory can have up to 10,000 management groups. Everything sits under one root management group.
Experienced developer How would you design a management group hierarchy?
Model answer
Keep it shallow and based on governance needs, not the org chart. A common pattern from Azure landing zones is root, then Platform (identity, connectivity, management) and Landing Zones (corp, online), plus Sandbox and Decommissioned. Policies such as allowed regions and required tags go high up, with exceptions applied lower.
Test yourself with exercises
3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.
Quick revision
Key points
- Management groups organise subscriptions.
- Policy and RBAC on a management group are inherited by everything below.
- They can be nested (up to six levels below the root).
- One root management group per directory; each child has one parent.
Important terminology
- Management group
- A container above subscriptions used to apply policy and access across many subscriptions.
- Root management group
- The single top-level management group for a Microsoft Entra tenant.
- Inheritance
- Settings applied at a higher level automatically apply to everything below.
Common mistakes
- Thinking management groups contain resources directly. They contain subscriptions (and other management groups).
Exam tips
- "Apply a policy to many subscriptions at once" = management group.
Five quick revision questions
-
1.What do management groups contain?Show
Subscriptions and other management groups.
-
2.How deep can management groups be nested?Show
Up to six levels, not counting the root and subscription levels.
-
3.How many parents can a subscription have?Show
One.
-
4.What sits at the top of every hierarchy?Show
The root management group.
-
5.Why use management groups?Show
To apply governance such as policy and access across many subscriptions at once.
Official references
Finished this lesson? Tick it off. Your progress is saved in this browser.
Next up: The Azure Management Hierarchy