Azure CLI Azure Cloud Shell Azure PowerShell Connect-AzAccount Get-AzManagementGroup Get-AzSubscription Get-Command Microsoft Microsoft Azure New-AzManagementGroup New-AzManagementGroupSubscription Remove-AzManagementGroup Remove-AzManagementGroupSubscription Select-AzSubscription Update-AzManagementGroup
Hi, today I want to talk to you about Azure Management Groups. These groups help us create an effective and efficient hierarchy to manage our Azure subscriptions. If you have many subscriptions, at some point you will need a way to effectively manage access, policy, and compliance for those subscriptions. Azure Management Groups offer us a level of scope that is above subscriptions. In this post I will show you how to create, list, update and delete Azure Management Groups using PowerShell and Azure CLI.
Prerequisites
This tutorial assumes that you already have a Microsoft Azure account configured.
If you want to know how to install the PowerShell Azure module on your machine, check out this
link. The simplest way to get started is to sign in interactively at the command line.
Connect-AzAccount
This cmdlet will bring up a dialog box prompting you for your email address and password associated with your Azure account. If you have more than one subscription associated with your mail account, you can choose the default subscription. To perform this task, we will use the following commands:
Once you set your default subscription, you’re ready to start. First, use the following command to list the cmdlets available to interact with the Management Groups.
Once the desired management group structure has been created, you can move or link your subscriptions to your management groups. To move subscriptions in PowerShell, you should use the New-AzManagementGroupSubscription cmdlet.
In this case, we will use Azure Cloud Shell, a browser-based shell built into Azure Portal. This allows us to use the Azure command-line tools (Azure CLI and Azure PowerShell) directly from a browser. If you want to know more about Azure Cloud Shell, check out this
link. First, use the following command to list the commands available to work with the Management Groups.
To list all management groups, you should use the following command.
az account management-group list
In my case, I don’t have any group created yet and I only have the default group. By default, each directory is given a single top-level management group called the “Tenant Root Group” management group.
Once the desired management group structure has been created, you can move or link your subscriptions to your management groups. To move a subscription in Azure CLI, you should use the following command.
subscriptionid=$(az account show --subscription "My Subscription" --query "id" --out tsv)az account management-group subscription add \
--name "Production_Group"\
--subscription $subscriptionid
If you want to remove a subscription from a management group, use the following command.
subscriptionid=$(az account show --subscription "My Subscription" --query "id" --out tsv)az account management-group subscription remove \
--name "Production_Group"\
--subscription $subscriptionid