Design identity, governance, and monitoring solutions · Topic 5 of 6
Management Groups, Subscriptions and Tagging
AZ-305 governance structure: management groups, subscriptions, landing zone layout, tag strategy and deployment stacks replacing Blueprints.
- 5 min
- Management groups allow six levels below the root and 10,000 per tenant. Policy and RBAC inherit downward.
- The landing zone design has Platform, Landing zones (Corp and Online), Sandbox and Decommissioned groups. Internal apps go in Corp.
- A subscription is a boundary for billing, access and limits. Use separate subscriptions for different budgets or compliance.
What it is
A good Azure structure makes governance, billing and security easy. The hierarchy is management groups, then subscriptions, then resource groups, then resources. Policy and RBAC assigned high in the tree inherit downward. Tags add metadata for cost and operations. This topic is about designing that hierarchy and the standards that go with it.
How it works
Management groups
| Fact | Detail |
|---|---|
| Purpose | Apply Azure Policy and RBAC to many subscriptions at once |
| Depth | Six levels below the root, not counting subscriptions. Microsoft suggests keeping the tree flatter, about three to four levels |
| Size | Up to 10,000 management groups per tenant |
| Parents | Each management group or subscription has one parent |
| Root | One tenant root group. Avoid assigning at the root unless it truly applies to everything |
Design principles from the Cloud Adoption Framework: organise by what needs the same policy, not by the company's org chart. Do not mirror reporting lines.
Landing zone layout
The Azure landing zone reference design uses these management groups:
| Group | Contains |
|---|---|
| Platform | Identity, Management and Connectivity subscriptions that provide shared services |
| Landing zones | Application subscriptions, split into Corp (internal, private connectivity to the hub, shared directory services) and Online (internet facing) |
| Sandbox | Disconnected subscriptions for experiments |
| Decommissioned | Subscriptions awaiting removal |
An internal HR application that must be reachable only from the corporate network belongs in Corp with its virtual network peered to the hub. A public website belongs in Online.
Subscriptions
A subscription is a billing, access and quota boundary. Create separate subscriptions for production and non production, for different business units with their own budgets, for workloads with different compliance rules, or when you approach service limits. Use subscription vending to create new subscriptions automatically from a template with policy already applied. A subscription belongs to one Entra tenant.
Resource groups
Resource groups hold resources that share a lifecycle: deploy, update and delete together. Choose a region for the group's metadata. Resources in a group can sit in different regions. Apply resource locks (CanNotDelete or ReadOnly) to protect critical items, and note that locks apply regardless of RBAC role.
Tagging strategy
Tags are name value pairs for cost allocation, ownership, environment and automation.
| Limit | Value |
|---|---|
| Tags per resource, resource group or subscription | 50 |
| Tag name length | 512 characters |
| Tag value length | 256 characters |
Some services support fewer tags, such as 15 for API Management and Azure Automation. Tags are not inherited from resource groups by default. Enforce a standard with Azure Policy: require a tag with the deny effect, inherit a tag from the resource group with the modify effect, and audit missing tags. Typical tags: CostCenter, Owner, Environment, Application. Use Cost Management to group costs by tag.
Standardising deployments
Azure Blueprints is retiring. The replacement is template specs (versioned templates stored in Azure) deployed as deployment stacks, which manage a group of resources as a unit and use deny settings to stop users deleting or changing the managed resources. Combine with Azure Policy initiatives and IaC (Bicep) in pipelines.
Choosing quickly
| Requirement | Answer |
|---|---|
| Apply a security policy to all production subscriptions | A management group for production with the policy assigned |
| New teams get a compliant subscription automatically | Subscription vending with policy inherited from the management group |
| Charge costs to departments | Tags enforced by policy, plus separate subscriptions where budgets differ |
| Prevent deletion of a critical resource group | A CanNotDelete lock |
| Redeploy standard resources and block edits | Template specs deployed as deployment stacks with deny settings |
A worked scenario
A retailer designs a hierarchy: a Platform group for identity, management and connectivity, a Landing zones group with Corp and Online children, and Sandbox. Policies assigned at Landing zones require encryption and allowed regions. Policy at Corp denies public IP addresses. Every resource must carry CostCenter and Owner, enforced by a require tag policy with a modify policy that inherits CostCenter from the resource group. Standard network resources are deployed as deployment stacks from template specs.
What to remember for the exam
- Management groups allow six levels below the root and 10,000 per tenant. Policy and RBAC inherit downward.
- The landing zone design has Platform, Landing zones (Corp and Online), Sandbox and Decommissioned groups. Internal apps go in Corp.
- A subscription is a boundary for billing, access and limits. Use separate subscriptions for different budgets or compliance.
- Each resource can have 50 tags, and tags are not inherited unless a policy copies them.
- Azure Blueprints is retiring. Use template specs with deployment stacks and deny settings.
Structure by policy needs, not by org chart. If two groups need different policy, they belong in different management groups.
How the exam asks about this
- "Apply the same policy to 40 production subscriptions." A management group.
- "An internal app uses shared directory services and a private network." The Corp management group.
- "Make every resource carry the cost center of its resource group." A modify policy that inherits the tag.
- "Replace Azure Blueprints to deploy templates and prevent deletion." Deployment stacks with deny settings.
Common mistakes
Mirroring the org chart. Policy needs drive structure.
Deep hierarchies. Keep three to four levels.
Assuming tags inherit. They do not.
Putting everything in one subscription. Limits and billing become hard.
Check yourself
How deep can management groups nest?
Six levels below the root, not counting subscriptions.
How many tags can a resource have?
50.
What replaces Azure Blueprints?
Template specs deployed as deployment stacks.
Topic 5 of 6 in Design identity, governance, and monitoring solutions
Test yourself on Design identity, governance, and monitoring solutions
The full Microsoft AZ-305 question bank has 755 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.