MSDEVBUILD / azure

The Azure Management Hierarchy

🏢 Root management group 📁 MG: Production 📁 MG: Development 🔑 Sub: Web🔑 Sub: Data🔑 Sub: Dev 📦 rg-web📦 rg-api📦 rg-test 🖥️🗄️🌍🖥️🧪 Policy set here… 📜 Policyis inherited byeverything below Management groups → subscriptions → resource groups → resources
Management groups, then subscriptions, then resource groups, then resources. Rules flow down like water.

😟 THE PROBLEM

Rules and permissions are set in random places and nobody knows what applies where.

😊 THE SOLUTION

Use the four-level hierarchy and apply each rule at the right scope.

  • Settings scattered everywhere✓ Broad rules high, specific rules low
  • Unsure who can access what✓ Permissions inherit down predictably
  • Auditors want one view✓ One policy at the top covers all
🛠️ Solved with: Azure management hierarchy
Try it yourself in the Azure simulator No Azure account needed. Your first resource group 📦 Try it ❯
Module 2: Architecture & Services ⏱ 5 min read Updated 11 Nov 2026

Quick answer

Azure organises everything in four levels: management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources. Policies and access applied at a higher level are inherited by everything below it.

Exam objective: 2.1.7 Describe the hierarchy of resource groups, subscriptions, and management groups. (Skills measured as of July 20, 2026)

Start with a question

If a rule is set at the very top of your company’s Azure, how far down does it reach?

All the way down. That is the power of the management hierarchy.

Explain it like I’m 10

The technical explanation

LevelContainsTypical use
Management groupSubscriptions, other management groupsCompany-wide policy and access
SubscriptionResource groupsBilling and access boundary
Resource groupResourcesLifecycle grouping for an app or environment
Resource–The actual VM, database, storage account…

  1. 1 Management group

    Policy: allowed regions = Europe only.

  2. 2 Subscription

    Inherits the policy. Adds RBAC for the web team.

  3. 3 Resource group

    Inherits both. Adds a delete lock.

  4. 4 Resource

    A VM in West Europe follows all of the above.

Inheritance flows down the hierarchy

Real-world business scenario

Banking

A bank

The problem
Auditors wanted proof that every resource met encryption and location rules across 30 subscriptions.
What they used
Assigned policy initiatives at the top management group and reviewed compliance in Azure Policy.
Why that choice
Inheritance guarantees the rules apply everywhere below, including subscriptions created later.
The result
One compliance dashboard covered every subscription.

When to use it and when not to

✓ Use it when…

  • Use the hierarchy to apply rules at the right scope: broad rules high, specific rules low.

✕ Think twice when…

  • Assigning the same policy separately to many subscriptions instead of once at a management group.
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner Describe the Azure management hierarchy from top to bottom.

Model answer

Management groups at the top, then subscriptions, then resource groups, then resources. Anything I set at a level, like a policy or permission, flows down to the levels below.

Intermediate If you give someone the Reader role on a subscription, what can they read?

Model answer

Everything inside that subscription: all its resource groups and resources, because role assignments are inherited down the hierarchy.

Experienced developer Where would you assign a policy that requires a cost-centre tag on every resource in the company?

Model answer

At the highest management group that covers all subscriptions, usually the root or a top-level landing zone group, so every current and future subscription inherits it. I would start in audit mode, then move to deny or modify once teams have adapted.

Test yourself with exercises

3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 3

Which list is in the correct order from the TOP of the hierarchy to the BOTTOM?

Question 2

Question 2 of 3

A user is assigned the Contributor role on a resource group. Where does the permission apply?

Question 3

Question 3 of 3

Where is the best place to assign a company-wide policy?

Quick revision

Key points

  • Management groups → subscriptions → resource groups → resources.
  • Settings flow down (inheritance).
  • Apply broad rules high up, specific rules low down.

Important terminology

Scope
The level where you apply a setting, such as a management group, subscription, resource group or resource.
Inheritance
Settings at a parent scope automatically apply to child scopes.

Common mistakes

  • Putting the levels in the wrong order on the exam.

Exam tips

  • Memorise the order. MG → Sub → RG → Resource.

Five quick revision questions

  1. 1.What is the top level of the Azure hierarchy?Show

    Management groups (under the root management group).

  2. 2.What is directly below a subscription?Show

    Resource groups.

  3. 3.Where do resources live?Show

    In resource groups.

  4. 4.Do settings flow up or down the hierarchy?Show

    Down.

  5. 5.Where should company-wide policies be assigned?Show

    At a high-level management group.

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: Compute Types: VMs, Containers and Functions