This chapter expands on the brief management-group coverage from the subscriptions chapter, focusing on their role in governance at scale. AZ-900 tests this under objective 2.1.
Jump to a section
A simple way to picture Azure Management Groups Hierarchy
A large filing cabinet doesn't just have folders — it has drawers, and each drawer can contain multiple folders. If you want to apply a label or rule to an entire drawer at once, you don't label each folder individually — you label the drawer, and all folders inside inherit that organization. Azure Management Groups work similarly: they're an organizational layer above resource groups (and subscriptions), letting you apply governance policies to many subscriptions at once.
What management groups are
Management groups are an organizational layer above subscriptions, grouping multiple subscriptions together for the purpose of applying policies, access control, and governance consistently across them, rather than managing each subscription individually.
Why they exist
Large organizations often have many subscriptions — one per business unit, per environment, per customer, or per project — and management groups provide a way to apply consistent governance across all of them at once, rather than configuring each subscription separately.
They're optional
Unlike subscriptions and resource groups (which are always present in every Azure deployment), management groups are optional and mainly used by larger organizations managing multiple subscriptions. A single-subscription account doesn't need management groups at all.
How they relate to subscriptions and resource groups
The hierarchy runs: Management Groups (optional, organizational layer) → Subscriptions (billing and access boundary) → Resource Groups (logical containers for resources) → Resources (individual services). Policies and access control can be applied at any level and generally flow down to the levels beneath it.
Create management groups if needed
For organizations with multiple subscriptions, management groups provide an organizational layer above them.
Organize subscriptions into management groups
Multiple subscriptions can be grouped together under a management group for coordinated governance.
Apply policies at the management group level
Policies can be applied at the management group level, affecting all subscriptions within it, rather than configuring each subscription individually.
A large organization with dozens of subscriptions uses management groups to organize them by business unit, applying consistent security policies to all subscriptions within each unit at once, rather than managing policies individually for every subscription.
Objective 2.1 expects candidates to understand management groups as an optional organizational layer for larger organizations, not a required component of every Azure deployment.
A common wrong answer is assuming every organization needs management groups — they're optional and mainly useful for larger organizations with multiple subscriptions.
Stable terms: management group. Memory trick: management groups = optional organizational layer above subscriptions, used by larger organizations to apply consistent governance across many subscriptions at once.
Management groups are an optional organizational layer above subscriptions for larger organizations.
They allow policies and access control to be applied across multiple subscriptions at once.
The organizational hierarchy runs: Management Groups → Subscriptions → Resource Groups → Resources.
A single-subscription organization doesn't necessarily need management groups.
These come up on the exam all the time. Here's how to tell them apart.
Management Groups
Optional organizational layer above subscriptions
Used by larger organizations with many subscriptions
Apply governance across multiple subscriptions at once
Resource Groups
Required container for resources
Exists within a subscription
Organizes resources for management purposes
Mistake
Every Azure organization must use management groups.
Correct
They're optional and mainly useful for larger organizations managing multiple subscriptions — a single-subscription account doesn't need them.
Mistake
Management groups are the same as resource groups.
Correct
They serve different purposes — management groups organize subscriptions; resource groups organize resources within a subscription.
They're an organizational layer above subscriptions that allows policies and access control to be applied to multiple subscriptions at once, useful for larger organizations managing many subscriptions together.
No — they're optional and mainly useful for larger organizations managing multiple subscriptions. A single-subscription account doesn't need them.
They serve different purposes and operate at different levels — management groups organize subscriptions; resource groups organize resources within a subscription.
You've just covered Azure Management Groups Hierarchy — now see how well it sticks with free AZ-900 practice questions. Full explanations included, no account needed.
Done with this chapter?