Management Groups Permissions

For hands-on on these topics run the demo.

Policy Inheritance

Policies applied to Management Groups and inherited by Subscriptions.

Let’s consider the following configuration:

Management Groups

And the following policies applied:

PolicyResourceApplied To
Not Allowed Resources TypesVirtual NetworksTenant Root Group
Allowed Resources TypesVirtual NetworksManagementGroup12

These operations are not allowed:

  • Create a Virtual Network in Subscription1
  • Create a Virtual Machine in Subscription2

Adding Subscriptions

It is not possible to add subscription to more than one management group.

For example, giving the same scenario above, this command would fail:

az account management-group subscription add -n '<management-group-11>' -s 'Subscription1'