The Azure Hierarchy: Management Groups to Resource Groups

You create four management groups, move your subscription, test inheritance with a Reader role, then lock a resource group. The management group tree stays for later lessons; the role, lock and resource group are cleaned up at the end.

1Create the management group tree

Run this:

$sub = az account show --query id -o tsv
az account management-group create --name mg-saatvedha --display-name "SaatVedha" -o none
foreach ($m in 'platform','workloads','sandbox') {
    az account management-group create --name "mg-saat-$m" --display-name "SaatVedha $m" --parent mg-saatvedha -o none
}
az account management-group list --query "[?starts_with(name,'mg-saat')].{name:name, display:displayName}" -o table

You should see something like this:

Name               Display
-----------------  ------------------
mg-saatvedha       SaatVedha
mg-saat-platform   SaatVedha platform
mg-saat-sandbox    SaatVedha sandbox
mg-saat-workloads  SaatVedha workloads

The first command can take a minute: if this is the first management group in your tenant, Azure also sets up the Tenant root group behind the scenes and puts your subscription under it.

2Move your subscription into Sandbox

Run this:

az account management-group subscription add --name mg-saat-sandbox --subscription $sub
az account management-group show --name mg-saatvedha --expand --recurse --query "children[].{group:displayName, inside:children[].displayName}" -o json

You should see something like this:

[
  {
    "group": "SaatVedha platform",
    "inside": null
  },
  {
    "group": "SaatVedha sandbox",
    "inside": [
      "Azure subscription 1"
    ]
  },
  {
    "group": "SaatVedha workloads",
    "inside": null
  }
]

Your subscription now sits at Tenant root group → SaatVedha → SaatVedha sandbox. Anything you assign to those levels reaches it.

3Prove inheritance with a Reader role

Give the helpdesk group from Lesson 5 Reader on the Sandbox management group, not on the subscription. Then ask the subscription who can read it.

Run this:

$grp = az ad group show --group grp-saat-helpdesk --query id -o tsv
az role assignment create --assignee-object-id $grp --assignee-principal-type Group --role Reader --scope /providers/Microsoft.Management/managementGroups/mg-saat-sandbox -o none
az role assignment list --scope "/subscriptions/$sub" --include-inherited --query "[?principalId=='$grp'].{who:principalName, role:roleDefinitionName, from:scope}" -o table

You should see something like this:

Who                Role    From
-----------------  ------  ------------------------------------------------------------
grp-saat-helpdesk  Reader  /providers/Microsoft.Management/managementGroups/mg-saat-sandbox

The subscription lists the role even though it was given two levels up. Optional: sign in as Asha in a private window. She can now see “Azure subscription 1” and its resource groups, read-only.

It can take a few minutes to appear.

Remove it again; Lesson 7 does roles properly:

az role assignment delete --assignee $grp --role Reader --scope /providers/Microsoft.Management/managementGroups/mg-saat-sandbox

4Create a resource group and lock it

Run this:

az group create --name rg-saat-l06 --tags course=saatvedha-azure lesson=06 -o none
az lock create --name lock-no-delete --lock-type CanNotDelete --resource-group rg-saat-l06 --notes "Course lab: protect from delete" -o none
az lock list --resource-group rg-saat-l06 --query "[].{name:name, level:level, notes:notes}" -o table

You should see something like this:

Name            Level         Notes
--------------  ------------  ------------------------------
lock-no-delete  CanNotDelete  Course lab: protect from delete

✅ Checkpoint: Your subscription is under mg-saat-sandbox, the Reader role is removed, and rg-saat-l06 has a CanNotDelete lock. Keep the lock for “Break It”.