Managing Subscriptions and RBAC||Governance and Compliance||What are Management Groups?||Azure

Task 1: Implement Management Groups
Task 2: Create custom RBAC roles

This Series is related to AZ-104-MicrosoftAzureAdministrator labs.
This exam measures your ability to accomplish the following technical tasks:
manage Azure identities and governance;
implement and manage storage;
deploy and manage Azure compute resources;
configure and manage virtual networking;
and monitor and back up Azure resources.
Related Videos:

Playlists:

AZ500(Microsoft Azure Security Technologies) playlist:

AZ700(Designing and Implementing Microsoft Azure Networking Solutions) playlist:

AZ900(Microsoft Azure Fundamentals) playlist:

SC300(Microsoft Identity and Access Administrator):

Machine learning playlist
Management groups are containers that help you manage access, policy, and compliance across multiple subscriptions. Create these containers to build an effective and efficient hierarchy that can be used with Azure Policy and Azure Role Based Access Controls. For more information on management groups, see Organize your resources with Azure management groups.

The first management group created in the directory could take up to 15 minutes to complete. There are processes that run the first time to set up the management groups service within Azure for your directory. You receive a notification when the process is complete

All subscriptions within a management group automatically inherit the controls applied to the management group. No matter if you have an Enterprise Agreement, Certified Solution Partner, Pay-As-You-Go, or any other type of subscription, this service gives all Azure customers enterprise-grade management at a large scale for no additional cost.

With the GA launch of this service, we introduce new functionality to Azure that allows customers to group subscriptions together so that you can apply a policy or RBAC role to multiple subscriptions, and their resources, with one assignment. Management groups not only allow you to group subscriptions but also allows you to group other management groups to form a hierarchy. The following diagram shows an example of creating a hierarchy for governance using management groups.

By creating a hierarchy like this you can apply a policy, for example, VM locations limited to US West Region on the group “Infrastructure Team management group” to enable internal compliance and security policies. This policy will inherit onto both EA subscriptions under that management group and will apply to all VMs under those subscriptions. As this policy inherits from the management group to the subscriptions, this security policy cannot be altered by the resource or subscription owner allowing for improved governance.

By using management groups, you can reduce your workload and reduce the risk of error by avoiding duplicate assignments. Instead of applying multiple assignments across numerous resources and subscriptions, you can apply the one assignment on the one management group that contains the target resources. This will save time in the application of assignments, creates one point for maintenance, and allows for better controls on who can control the assignment.

Another scenario where you would use management groups is to provide user access to multiple subscriptions. By moving multiple subscriptions under that management group, you have the ability create one RBAC assignment on the management group which will inherit that access to all the subscriptions. Without the need to script RBAC assignments over multiple subscriptions, one assignment on the management group can enable users to have access to everything they need.

Description reference:

useful links:

Please do follow:

You can also learn from Microsoft labs in Github.

This video is created for educational purposes (AZ104 course).
Here is the link to practice labs: