Azure Azure Governance Azure PowerShell

Azure PowerShell script: Create a management group tree hierarchy

Management groups can be used to effectively manage a company’s various Azure subscriptions and provide them a way to not only control and manage access, but also to apply policies and compliance in an organizational, environment-based or combined hierarchy.

To automate the deployment process of all my planned different child an parent management groups into a tree structure for my Azure test environment, I wrote the below Azure PowerShell script. This script not only allows me to quickly deploy the complete management group hierarchy. But it is easy to adjust, so it can be used during the deployment of a management group hierarchy for any customer environment.

This Azure PowerShell script will do all of the following:

  • Checks if PowerShell is run as administrator, otherwise the PowerShell window will be closed (only applies when running the script in Windows Terminal or Windows PowerShell).
  • Import the Azure PowerShell Az module into the PowerShell session.
  • Create new GUIDs for all management group IDs (GroupName*) and store them in variables.
  • Define all management group display names (DisplayName*) and store them in variables.
  • Create country management groups underneath the tenant root group (root management group).
  • Create department management groups underneath the country management groups.
  • Create environment management groups underneath the department management groups.

* The GroupName is a unique identifier which is used by other commands to reference the management group. This ID can not be changed after creation.

* The DisplayName is a human readable name used in the Azure Portal, and which can be changed at all times.


When you run the script, your management group tree hierarchy will be structured like shown in the picture below. To get a tree overview of your management groups structure, you can follow this Azure tip from a previous blog post.



Azure PowerShell script

<#

.SYNOPSIS

A script used to deploy a management group tree hierarchy

.DESCRIPTION

A script used to deploy a management group tree hierarchy

.NOTES

Filename:       Create_Azure_Management_Groups_Tree_Hierarchy.ps1
Created:        31/07/2020
Last modified:  31/07/2020
Author:         Wim Matthyssen
PowerShell:     PowerShell 5.1; Azure PowerShell
Version:        Install latest Az modules
Action:         Change variables where needed to fit your needs
Disclaimer:     This script is provided "As IS" with no warranties.

.EXAMPLE

.\Create_Azure_Management_Groups_Tree_Hierarchy.ps1

.LINK

#>

## ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

## Prerequisites

## Check if running as Administrator, otherwise close the PowerShell window

$CurrentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
$IsAdministrator = $CurrentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if ($IsAdministrator -eq $false) {
    Write-Host ($writeEmptyLine + "# Please run PowerShell as Administrator" + $writeSeperator + $time)`
    -foregroundcolor $foregroundColor1 $writeEmptyLine
    Start-Sleep -s 5
    exit
}

## Import Azure PowerShell Az module into the PowerShell session

Import-Module Az

## ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

## Variables

$customerName ="wma"
$spoke1 = "prd"
$spoke2 = "pre"
$spoke3 = "dev"

$beManagementGroupName = "mg-" + $customerName + "-be"
$beManagementGroupGuid = New-Guid
$usManagementGroupName = "mg-" + $customerName + "-us"
$usManagementGroupGuid = New-Guid

$itBeManagementGroupName = $beManagementGroupName + "-it"
$itBeManagementGroupGuid = New-Guid
$itUsManagementGroupName = $usManagementGroupName + "-it"
$itUsManagementGroupGuid = New-Guid

$spoke1ItBeManagementGroupName = $itBeManagementGroupName + "-" + $spoke1
$spoke1ItBeManagementGroupGuid = New-Guid
$spoke2ItBeManagementGroupName = $itBeManagementGroupName + "-" + $spoke2
$spoke2ItBeManagementGroupGuid = New-Guid
$spoke3ItBeManagementGroupName = $itBeManagementGroupName + "-" + $spoke3
$spoke3ItBeManagementGroupGuid = New-Guid

$spoke1ItUsManagementGroupName = $itUsManagementGroupName + "-" + $spoke1
$spoke1ItUsManagementGroupGuid = New-Guid
$spoke2ItUsManagementGroupName = $itUsManagementGroupName + "-" + $spoke2
$spoke2ItUsManagementGroupGuid = New-Guid
$spoke3ItUsManagementGroupName = $itUsManagementGroupName + "-" + $spoke3
$spoke3ItUsManagementGroupGuid = New-Guid

$global:currentTime = Set-PSBreakpoint -Variable currentTime -Mode Read -Action {Get-Date -UFormat "%A %m/%d/%Y %R"}
$foregroundColor1 = "Red"
$writeEmptyLine = "`n"
$writeSeperator = " - "

## ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

## Create country management groups

New-AzManagementGroup -GroupName $beManagementGroupGuid -DisplayName $beManagementGroupName
New-AzManagementGroup -GroupName $usManagementGroupGuid -DisplayName $usManagementGroupName

$beParentGroup = Get-AzManagementGroup -GroupName $beManagementGroupGuid
$usParentGroup = Get-AzManagementGroup -GroupName $usManagementGroupGuid

Write-Host ($writeEmptyLine + "# Country management groups created" + $writeSeperator + $currentTime) -foregroundcolor $foregroundColor1 $writeEmptyLine

## ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

## Create department management groups

New-AzManagementGroup -GroupName $itBeManagementGroupGuid -DisplayName $itBeManagementGroupName -ParentObject $beParentGroup
New-AzManagementGroup -GroupName $itUsManagementGroupGuid -DisplayName $itUsManagementGroupName -ParentObject $UsParentGroup

$beItParentGroup = Get-AzManagementGroup -GroupName $itBeManagementGroupGuid
$usItParentGroup = Get-AzManagementGroup -GroupName $itUsManagementGroupGuid

Write-Host ($writeEmptyLine + "# Department management groups created" + $writeSeperator + $currentTime) -foregroundcolor $foregroundColor1 $writeEmptyLine

## ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

## Create environment management groups

New-AzManagementGroup -GroupName $spoke1ItBeManagementGroupGuid -DisplayName $spoke1ItBeManagementGroupName -ParentObject $beItParentGroup
New-AzManagementGroup -GroupName $spoke2ItBeManagementGroupGuid -DisplayName $spoke2ItBeManagementGroupName -ParentObject $beItParentGroup
New-AzManagementGroup -GroupName $spoke3ItBeManagementGroupGuid -DisplayName $spoke3ItBeManagementGroupName -ParentObject $beItParentGroup

New-AzManagementGroup -GroupName $spoke1ItUsManagementGroupGuid -DisplayName $spoke1ItUsManagementGroupName -ParentObject $usItParentGroup
New-AzManagementGroup -GroupName $spoke2ItUsManagementGroupGuid -DisplayName $spoke2ItUsManagementGroupName -ParentObject $usItParentGroup
New-AzManagementGroup -GroupName $spoke3ItUsManagementGroupGuid -DisplayName $spoke3ItUsManagementGroupName -ParentObject $usItParentGroup

Write-Host ($writeEmptyLine + "# Environment management groups created" + $writeSeperator + $currentTime) -foregroundcolor $foregroundColor1 $writeEmptyLine

## ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



To use the script copy and save the above as Create_Management_Group_Tree_Hierarchy.ps1 or download it from GitHub. Afterwards run the script with Administrator privileges from Windows Terminal, Visual Studio Code, Cloud Shell or Windows PowerShell.



In a previous blog post I have already shown how you can change the display name of the root management group, which can be combined with this script to foresee a uniform naming convention for all your management groups display names.


Conclusion

Management groups are a way to proper organize a companies different Azure subscriptions. They bring more structure, by efficiently managing access, policies and costs in an organizational, environment-based or a combined hierarchy.

Management groups can be up to six levels deep, seven if you include the root management group, and a parent management group can have many child management groups. At the moment a total of up to 10,000 management groups is supported.

Just keep in mind that this number is a limit and definitely not a target. You should avoid to complex structures where it is difficult to keep a good overview or where it is almost impossible to find out which Azure Policy definition or RBAC assignment applies to which child or parent management group.

So I hope this Azure PowerShell script is useful for you and provides a good foundation to foresee a structured management group hierarchy in your Azure ecosystem. If you have any questions or recommendations about it, feel free to contact me through my Twitter handle or to leave a comment.

0 comments on “Azure PowerShell script: Create a management group tree hierarchy

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: