Manage your Azure subscriptions at scale with management groups
Change the name of a management group
You can change the name of the management group by using the Azure portal, Azure PowerShell, or the Azure CLI.
Change the name in the portal
Sign in to the Azure portal.
Select All services > Management groups.
Select the management group that you want to rename.
Select details.
Select the Rename Group option at the top of the pane.
On the Rename Group pane, enter the new name that you want to display.
Select Save.
Change the name in Azure PowerShell
To update the display name, use Update-AzManagementGroup in Azure PowerShell. For example, to change a management group's display name from Contoso IT to Contoso Group, run the following command:
Update-AzManagementGroup -GroupId 'ContosoIt' -DisplayName 'Contoso Group'
Change the name in the Azure CLI
For the Azure CLI, use the update command:
az account management-group update --name 'Contoso' --display-name 'Contoso Group'
Delete a management group
To delete a management group, you must meet the following requirements:
There are no child management groups or subscriptions under the management group. To move a subscription or management group to another management group, see Move management groups and subscriptions later in this article.
You need write permissions on the management group (Owner, Contributor, or Management Group Contributor). To see what permissions you have, select the management group and then select IAM. To learn more on Azure roles, see What is Azure role-based access control (Azure RBAC)?.
Delete a management group in the portal
Sign in to the Azure portal.
Select All services > Management groups.
Select the management group that you want to delete.
Select details.
Select Delete.
Tip
If the Delete button is unavailable, hovering over the button shows you the reason.
A dialog opens and asks you to confirm that you want to delete the management group.
Select Yes.
Delete a management group in Azure PowerShell
To delete a management group, use the Remove-AzManagementGroup command in Azure PowerShell:
Remove-AzManagementGroup -GroupId 'Contoso'
Delete a management group in the Azure CLI
With the Azure CLI, use the command az account management-group delete:
az account management-group delete --name 'Contoso'
View management groups
You can view any management group if you have a direct or inherited Azure role on it.
View management groups in the portal
Sign in to the Azure portal.
Select All services > Management groups.
The page for management group hierarchy appears. On this page, you can explore all the management groups and subscriptions that you have access to. Selecting the group name takes you to a lower level in the hierarchy. The navigation works the same as a file explorer does.
To see the details of the management group, select the (details) link next to the title of the management group. If this link isn't available, you don't have permissions to view that management group.
View management groups in Azure PowerShell
You use the Get-AzManagementGroup command to retrieve all groups. For the full list of GET PowerShell commands for management groups, see the Az.Resources modules.
Get-AzManagementGroup
For a single management group's information, use the -GroupId parameter:
Get-AzManagementGroup -GroupId 'Contoso'
To return a specific management group and all the levels of the hierarchy under it, use the -Expand and -Recurse parameters:
PS C:\> $response = Get-AzManagementGroup -GroupId TestGroupParent -Expand -Recurse
PS C:\> $response
Id : /providers/Microsoft.Management/managementGroups/TestGroupParent
Type : /providers/Microsoft.Management/managementGroups
Name : TestGroupParent
TenantId : 00000000-0000-0000-0000-000000000000
DisplayName : TestGroupParent
UpdatedTime : 2/1/2018 11:15:46 AM
UpdatedBy : 00000000-0000-0000-0000-000000000000
ParentId : /providers/Microsoft.Management/managementGroups/00000000-0000-0000-0000-000000000000
ParentName : 00000000-0000-0000-0000-000000000000
ParentDisplayName : 00000000-0000-0000-0000-000000000000
Children : {TestGroup1DisplayName, TestGroup2DisplayName}
PS C:\> $response.Children[0]
Type : /managementGroup
Id : /providers/Microsoft.Management/managementGroups/TestGroup1
Name : TestGroup1
DisplayName : TestGroup1DisplayName
Children : {TestRecurseChild}
PS C:\> $response.Children[0].Children[0]
Type : /managementGroup
Id : /providers/Microsoft.Management/managementGroups/TestRecurseChild
Name : TestRecurseChild
DisplayName : TestRecurseChild
Children :
View management groups in the Azure CLI
You use the list command to retrieve all groups:
az account management-group list
For a single management group's information, use the show command:
az account management-group show --name 'Contoso'
To return a specific management group and all the levels of the hierarchy under it, use the -Expand and -Recurse parameters:
az account management-group show --name 'Contoso' -e -r
Move management groups and subscriptions
One reason to create a management group is to bundle subscriptions together. Only management groups and subscriptions can become children of another management group. A subscription that moves to a management group inherits all user access and policies from the parent management group.
You can move subscriptions between management groups. A subscription can have only one parent management group.
When you move a management group or subscription to be a child of another management group, three rules need to be evaluated as true.
If you're doing the move action, you need permission at each of the following layers:
- Child subscription or management group
Microsoft.management/managementgroups/writeMicrosoft.management/managementgroups/subscriptions/write(only for subscriptions)Microsoft.Authorization/roleAssignments/writeMicrosoft.Authorization/roleAssignments/deleteMicrosoft.Management/register/action
- Target parent management group
Microsoft.management/managementgroups/write
- Current parent management group
Microsoft.management/managementgroups/write
There's an exception: if the target or the existing parent management group is the root management group, the permission requirements don't apply. Because the root management group is the default landing spot for all new management groups and subscriptions, you don't need permissions on it to move an item.
If the Owner role on the subscription is inherited from the current management group, your move targets are limited. You can move the subscription only to another management group where you have the Owner role. You can't move the subscription to a management group where you're only a Contributor because you would lose ownership of the subscription. If you're directly assigned to the Owner role for the subscription, you can move it to any management group where you have the Contributor role.
To see what permissions you have in the Azure portal, select the management group and then select IAM. To learn more about Azure roles, see What is Azure role-based access control (Azure RBAC)?.
Add an existing subscription to a management group in the portal
Sign in to the Azure portal.
Select All services > Management groups.
Select the management group that you want to be the parent.
At the top of the page, select Add subscription.
Select the subscription in the list with the correct ID.
Select Save.
Remove a subscription from a management group in the portal
Sign in to the Azure portal.
Select All services > Management groups.
Select the management group that's the current parent.
Select the ellipsis (
...) at the end of the row for the subscription in the list that you want to move.
Select Move.
On Move pane, select the value for New parent management group ID.
Select Save.
Move a subscription in Azure PowerShell
To move a subscription in PowerShell, you use the New-AzManagementGroupSubscription command:
New-AzManagementGroupSubscription -GroupId 'Contoso' -SubscriptionId '12345678-1234-1234-1234-123456789012'
To remove the link between the subscription and the management group, use the Remove-AzManagementGroupSubscription command:
Remove-AzManagementGroupSubscription -GroupId 'Contoso' -SubscriptionId '12345678-1234-1234-1234-123456789012'
Move a subscription in the Azure CLI
To move a subscription in the Azure CLI, you use the add command:
az account management-group subscription add --name 'Contoso' --subscription '12345678-1234-1234-1234-123456789012'
To remove the subscription from the management group, use the subscription remove command:
az account management-group subscription remove --name 'Contoso' --subscription '12345678-1234-1234-1234-123456789012'
Move a subscription in an ARM template
To move a subscription in an Azure Resource Manager template (ARM template), use the following template and deploy it at the tenant level:
{
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"targetMgId": {
"type": "string",
"metadata": {
"description": "Provide the ID of the management group that you want to move the subscription to."
}
},
"subscriptionId": {
"type": "string",
"metadata": {
"description": "Provide the ID of the existing subscription to move."
}
}
},
"resources": [
{
"scope": "/",
"type": "Microsoft.Management/managementGroups/subscriptions",
"apiVersion": "2020-05-01",
"name": "[concat(parameters('targetMgId'), '/', parameters('subscriptionId'))]",
"properties": {
}
}
],
"outputs": {}
}
Or, use the following Bicep file:
targetScope = 'managementGroup'
@description('Provide the ID of the management group that you want to move the subscription to.')
param targetMgId string
@description('Provide the ID of the existing subscription to move.')
param subscriptionId string
resource subToMG 'Microsoft.Management/managementGroups/subscriptions@2020-05-01' = {
scope: tenant()
name: '${targetMgId}/${subscriptionId}'
}
Move a management group in the portal
Sign in to the Azure portal.
Select All services > Management groups.
Select the management group that you want to be the parent.
At the top of the page, select Add management group.
On the Add management group pane, choose whether you want to use a new or existing management group:
- Selecting Create new creates a new management group.
- Selecting Use existing presents you with a dropdown list of all the management groups that you can move to this management group.
Select Save.
Move a management group in Azure PowerShell
To move a management group under a different group, use the Update-AzManagementGroup command in Azure PowerShell:
$parentGroup = Get-AzManagementGroup -GroupId ContosoIT
Update-AzManagementGroup -GroupId 'Contoso' -ParentId $parentGroup.id
Move a management group in the Azure CLI
To move a management group in the Azure CLI, use the update command:
az account management-group update --name 'Contoso' --parent ContosoIT
Audit management groups by using activity logs
Management groups are supported in Azure Monitor activity logs. You can query all events that happen to a management group in the same central location as other Azure resources. For example, you can see all role assignments or policy assignment changes made to a particular management group.
When you want to query on management groups outside the Azure portal, the target scope for management groups looks like "/providers/Microsoft.Management/managementGroups/{yourMgID}".
No comments:
Post a Comment