You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Create management groups to organize resources - Azure Governance
3
3
description: Learn how to create Azure management groups to manage multiple resources using the portal, Azure PowerShell, and Azure CLI.
4
-
ms.date: 12/18/2019
4
+
ms.date: 04/15/2020
5
5
ms.topic: conceptual
6
6
---
7
7
# Create management groups for resource organization and management
8
8
9
-
Management groups are containers that help you manage access, policy, and compliance across
10
-
multiple subscriptions. Create these containers to build an effective and efficient hierarchy that
11
-
can be used with [Azure Policy](../policy/overview.md) and [Azure Role Based
12
-
Access Controls](../../role-based-access-control/overview.md). For more information on management
13
-
groups, see [Organize your resources with Azure management groups](overview.md).
9
+
Management groups are containers that help you manage access, policy, and compliance across multiple
10
+
subscriptions. Create these containers to build an effective and efficient hierarchy that can be
11
+
used with [Azure Policy](../policy/overview.md) and [Azure Role Based Access
12
+
Controls](../../role-based-access-control/overview.md). For more information on management groups,
13
+
see [Organize your resources with Azure management groups](overview.md).
14
14
15
15
The first management group created in the directory could take up to 15 minutes to complete. There
16
16
are processes that run the first time to set up the management groups service within Azure for your
17
-
directory. You receive a notification when the process is complete. For more information, see [initial setup of management groups](./overview.md#initial-setup-of-management-groups).
17
+
directory. You receive a notification when the process is complete. For more information, see
18
+
[initial setup of management groups](./overview.md#initial-setup-of-management-groups).
18
19
19
20
## Create a management group
20
21
21
-
Any Azure AD user in the tenant can create a management group without the management group write permission assigned to that user. This new management group will be a child of the Root Management Group and the creator will be given an "Owner" role assignment. Management group service allows this ability so that role assignments are not needed at the root level. No users have access to the Root Management Group when it is created. To avoid the hurdle of finding the Azure AD Global Admins to start using management groups, we allow the creation of the initial management groups at the root level.
22
+
Any Azure AD user in the tenant can create a management group without the management group write
23
+
permission assigned to that user. This new management group will be a child of the Root Management
24
+
Group and the creator will be given an "Owner" role assignment. Management group service allows this
25
+
ability so that role assignments are not needed at the root level. No users have access to the Root
26
+
Management Group when it is created. To avoid the hurdle of finding the Azure AD Global Admins to
27
+
start using management groups, we allow the creation of the initial management groups at the root
28
+
level.
22
29
23
30
You can create the management group by using the portal, a
46
+
:::image type="content" source="./media/main.png" alt-text="Page for working with management groups" border="false":::
40
47
41
48
1. Fill in the management group ID field.
42
49
43
-
- The **Management Group ID** is the directory unique identifier that is used to submit commands on this management group. This identifier isn't editable after creation as it is used throughout the Azure system to identify this group. The [root management group](overview.md#root-management-group-for-each-directory) is automatically created with an ID that is the Azure Active Directory ID. For all other management groups, assign a unique ID.
44
-
- The display name field is the name that is displayed within the Azure portal. A separate display name is an optional field when creating the management group and can be changed at any time.
50
+
- The **Management Group ID** is the directory unique identifier that is used to submit commands
51
+
on this management group. This identifier isn't editable after creation as it is used
52
+
throughout the Azure system to identify this group. The
53
+
[root management group](overview.md#root-management-group-for-each-directory) is automatically
54
+
created with an ID that is the Azure Active Directory ID. For all other management groups,
55
+
assign a unique ID.
56
+
- The display name field is the name that is displayed within the Azure portal. A separate
57
+
display name is an optional field when creating the management group and can be changed at any
58
+
time.
45
59
46
-
60
+
:::image type="content" source="./media/create_context_menu.png" alt-text="Options pane for creating a new management group" border="false":::
47
61
48
62
1. Select **Save**.
49
63
50
64
### Create in PowerShell
51
65
52
-
For PowerShell, use the [New-AzManagementGroup](/powershell/module/az.resources/new-azmanagementgroup) cmdlet to create a new management group.
66
+
For PowerShell, use the
67
+
[New-AzManagementGroup](/powershell/module/az.resources/new-azmanagementgroup) cmdlet to create a
68
+
new management group.
53
69
54
70
```azurepowershell-interactive
55
71
New-AzManagementGroup -GroupName 'Contoso'
56
72
```
57
73
58
-
The **GroupName** is a unique identifier being created. This ID is used by other commands to reference this group and it can't be changed later.
74
+
The **GroupName** is a unique identifier being created. This ID is used by other commands to
75
+
reference this group and it can't be changed later.
59
76
60
-
If you want the management group to show a different name within the Azure portal, add the **DisplayName** parameter. For example, to create a management group with the GroupName of Contoso and the display name of "Contoso Group", use the following cmdlet:
77
+
If you want the management group to show a different name within the Azure portal, add the
78
+
**DisplayName** parameter. For example, to create a management group with the GroupName of Contoso
79
+
and the display name of "Contoso Group", use the following cmdlet:
In the preceding examples, the new management group is created under the root management group. To specify a different management group as the parent, use the **ParentId** parameter.
85
+
In the preceding examples, the new management group is created under the root management group. To
86
+
specify a different management group as the parent, use the **ParentId** parameter.
For Azure CLI, use the [az account management-group create](/cli/azure/account/management-group?view=azure-cli-latest#az-account-management-group-create) command to create a new management group.
The **name** is a unique identifier being created. This ID is used by other commands to reference this group and it can't be changed later.
103
+
The **name** is a unique identifier being created. This ID is used by other commands to reference
104
+
this group and it can't be changed later.
82
105
83
-
If you want the management group to show a different name within the Azure portal, add the **display-name** parameter. For example, to create a management group with the GroupName of Contoso and the display name of "Contoso Group", use the following command:
106
+
If you want the management group to show a different name within the Azure portal, add the
107
+
**display-name** parameter. For example, to create a management group with the GroupName of Contoso
108
+
and the display name of "Contoso Group", use the following command:
84
109
85
110
```azurecli-interactive
86
111
az account management-group create --name Contoso --display-name 'Contoso Group'
87
112
```
88
113
89
-
In the preceding examples, the new management group is created under the root management group. To specify a different management group as the parent, use the **parent** parameter and provide the name of the parent group.
114
+
In the preceding examples, the new management group is created under the root management group. To
115
+
specify a different management group as the parent, use the **parent** parameter and provide the
116
+
name of the parent group.
90
117
91
118
```azurecli-interactive
92
119
az account management-group create --name ContosoSubGroup --parent Contoso
0 commit comments