Gain control with Azure Management Groups

As enterprises start to move to Azure, managing subscriptions becomes tedious with the growing number of subscriptions. In an organization, there are usually many employees and, in some cases, many applications. If all these employees are provided Azure subscriptions and start creating Azure resources at will, it may soon become difficult to control, manage, and track who creates what. Eventually, the costs may go out of control. However, organizing your subscriptions using Azure Management Group can make the job very easy.

What is an Azure Management Group?

Management groups are logical groups for Azure subscriptions, allowing you to organize subscriptions and apply governance controls, such as Azure Policy and Role-Based Access Controls (RBAC), to the management groups. All subscriptions within a management group automatically inherit the controls applied to the management group.

When do you need to organize your subscriptions?

Management groups are logical groups for Azure subscriptions, allowing you to organize subscriptions and apply governance controls, such as Azure Policy and Role-Based Access Controls (RBAC), to the management groups. All subscriptions within a management group automatically inherit the controls applied to the management group.

Rules to consider when organizing

• Below can be accomplished through Management Groups:
  • Group Subscriptions according to your organizational models and single assignment of controls that apply to all subscriptions.
  • Create a flexible hierarchy that can be updated quickly and can easily scale up or down depending on the organization’s needs.
  • Use Azure Resource Manager to integrate with other Azure services like Policy, Cost Management, Blueprints, and Security Center.
• A few questions to answer before you should create a management group hierarchy:
  • What kinds of workloads are in each subscription?
  • What environment?
  • Which department/teams?
  • What are security rules being applied to these workloads?

Benefits of Azure Management Groups

• Provides a scope higher than a subscription to manage access, policies, and compliance efficiently.
• Aggregated views above the subscription level.
• Inheritance allows for a single assignment of controls that apply to a grouping of subscriptions.
• Create a hierarchy of Management Groups that fit your organization.
• Management Groups can be scaled up/down as needed.
• Management tree can support up to six levels.
• Each management group and subscription can only support one parent.
• Each management group can have multiple children.
• All subs and management groups fold up to one root management group within the directory.
• A newly onboarded subscription is added to Root Management Group by default.

Limitations of Azure Management Groups

• 10,000 Management Groups can be supported in a single directory.
• Management Group tree can support up to six levels of depth.
• Each management group and subscription can only support one parent.
• Each management group can have multiple children.
• Root management groups can’t be moved or deleted, unlike other management groups.

Role-Based Access (RBAC) in Management Groups

• You could apply your RBAC roles at the Management Group scope to have one central place that you could go to instead of fiddling around with every subscription.
• Azure roles can be applied to Management Groups, then inherited to all management groups and their subscriptions.
• Classic admin roles can’t be applied at the Management Group level and need to be applied at the subscription level.
• It is not possible to define a custom RBAC role at a Management Group.

Azure Blueprint to Management Group

Azure Blueprint is a feature that allows defining a package of artifacts (resource groups, Azure policies, role assignments & Resource Manager templates, and more) targeted to Management groups and Azure subscriptions to create consistent and repeatable environments.

Azure Policy Management Group

• Management groups are a convenient place for defining Azure ARM policies.
• You can apply Azure Policy, the service that allows you to create, assign and manage Azure policies at Management Group.
• All these policies are then applied to all resources under the management group.
• Allows your organization to set up Azure environments with consistent security policies.
• The ARM policy violations can be seen either in the Azure Policy blade or in Azure Security Center.

Easing Subscription Management

This blog has explained the Azure Management Group concept and how you can use this service to ease your managing subscriptions. Other services can be used at the Management Groups level but will be applied or inherited at the Subscription level. It is suggested to use Management Groups when the number of subscriptions, departments, applications, and users grows.

Whether you have an Enterprise Agreement, Cloud Solution Partner, Pay-As-You-Go, or any other type of subscription, this service gives all Azure customers enterprise-grade management at a large scale for no additional cost.

Resources:

• https://docs.microsoft.com/en-us/azure/governance/management-groups/overview