Azure Azure Governance Azure PowerShell

Azure PowerShell script: Create a management group tree hierarchy

Management groups can be used to effectively manage a company’s various Azure subscriptions and provide them a way to not only control and manage access, but also to apply policies and compliance in an organizational, environment-based or combined hierarchy.

To automate the deployment process of all my planned different child an parent management groups into a tree structure for my Azure test environment, I wrote the below Azure PowerShell script. This script not only allows me to quickly deploy the complete management group hierarchy based on the Enterprise-scale for small enterprises architecture. But it is easy to adjust, so it can be used during the deployment of a management group hierarchy for any customer environment.

This Azure PowerShell script will do all of the following:

  • Checks if PowerShell is run as administrator, otherwise the PowerShell window will be closed (only applies when running the script in Windows Terminal or Windows PowerShell).
  • Import the Azure PowerShell Az module into the PowerShell session.
  • Suppress Breaking Change Messages.
  • Create new GUIDs for all management group IDs (GroupId*) and store them in variables.
  • Define all management group display names (DisplayName*) and store them in variables.
  • Create a customer management group(s) underneath the tenant root group (root management group).
  • Create top management groups (Platform, Landing Zones, Sandboxes, Decommissioned) underneath the customer management group(s).
  • Create Platform management groups (Management, Connectivity) underneath the Platform management group.
  • Create Landing Zones management groups underneath the Landing Zones management group.

* The GroupId (previously GroupName) is a unique identifier which is used by other commands to reference the management group. This ID can not be changed after creation.

* The DisplayName is a human readable name used in the Azure Portal, and which can be changed at all times.

When you run the script, your management group tree hierarchy will be structured like shown in the picture below. To get a tree overview of your management groups structure, you can follow this Azure tip from a previous blog post. Or you can now also open Management groups from the Azure Preview Portal to get a nice and clear overview of your management groups structure.

Azure PowerShell script



A script used to deploy a management groups tree structure


A script used to deploy a management groups tree structure based on the Enterprise-scale architecture for small enterprises.
When all management groups are created the Azure subscriptions will be moved to the corresponding management group.


Filename:       Create_Azure_Management_Groups_Tree_Structure.ps1
Created:        31/07/2020
Last modified:  31/03/2021
Author:         Wim Matthyssen
PowerShell:     PowerShell 5.1; Azure PowerShell
Version:        Install latest Az modules
Action:         Change variables where needed to fit your needs
Disclaimer:     This script is provided "As IS" with no warranties.





## ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

## Prerequisites

## Check if running as Administrator, otherwise close the PowerShell window

$CurrentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
$IsAdministrator = $CurrentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if ($IsAdministrator -eq $false) {
    Write-Host ($writeEmptyLine + "# Please run PowerShell as Administrator" + $writeSeperator + $time)`
    -foregroundcolor $foregroundColor1 $writeEmptyLine
    Start-Sleep -s 5

## Import Azure PowerShell Az module into the PowerShell session

Import-Module Az

##  Suppress Breaking Change Messages

Set-Item Env:\SuppressAzurePowerShellBreakingChangeWarnings "true"

## ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

## Variables

$customerFullName = "myhcjourney"
$customerName ="myh"

$customerManagementGroupName = "mg-" + $customerFullName 
$customerManagementGroupGuid = New-Guid

$platformManagementGroupName = "mg-" + $customerName + "-platform"
$platformManagementGroupGuid = New-Guid
$landingZonesManagementGroupName = "mg-" + $customerName + "-landingzones"
$landingZonesManagementGroupGuid = New-Guid
$sandboxesManagementGroupName = "mg-" + $customerName + "-sandboxes"
$sandboxesManagementGroupGuid = New-Guid
$decommissionedManagementGroupName = "mg-" + $customerName + "-decommissioned"
$decommissionedManagementGroupGuid = New-Guid

$managemnetManagementGroupName = "mg-" + $customerName + "-management"
$managementManagementGroupGuid = New-Guid
$connectivityManagementGroupName = "mg-" + $customerName + "-connectivity"
$connectivityManagementGroupGuid = New-Guid

$corpManagementGroupName = "mg-" + $customerName + "-corp"
$corpManagementGroupGuid = New-Guid
$onlineManagementGroupName = "mg-" + $customerName + "-online"
$onlineManagementGroupGuid = New-Guid

$writeEmptyLine = "`n"
$writeSeperator = " - "
$writeSpace = " "
$global:currentTime= Set-PSBreakpoint -Variable currenttime -Mode Read -Action {$global:currentTime= Get-Date -UFormat "%A %m/%d/%Y %R"}
$foregroundColor1 = "Red"

## ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

## Create customer management group

New-AzManagementGroup -GroupId $customerManagementGroupGuid -DisplayName $customerManagementGroupName

$customerParentGroup = Get-AzManagementGroup -GroupId $customerManagementGroupGuid

Write-Host ($writeEmptyLine + "#" + $writeSpace + "Customer management group created" + $writeSeperator + $currentTime)`
-foregroundcolor $foregroundColor1 $writeEmptyLine

## ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

## Create top management groups (Platform, Landing Zones, Sandboxes, Decommissioned)

New-AzManagementGroup -GroupId $platformManagementGroupGuid -DisplayName $platformManagementGroupName -ParentObject $customerParentGroup
New-AzManagementGroup -GroupId $landingZonesManagementGroupGuid -DisplayName $landingZonesManagementGroupName -ParentObject $customerParentGroup
New-AzManagementGroup -GroupId $sandboxesManagementGroupGuid -DisplayName $sandboxesManagementGroupName -ParentObject $customerParentGroup
New-AzManagementGroup -GroupId $decommissionedManagementGroupGuid -DisplayName $decommissionedManagementGroupName -ParentObject $customerParentGroup

$platformParentGroup = Get-AzManagementGroup -GroupId $platformManagementGroupGuid 
$landingZonesParentGroup = Get-AzManagementGroup -GroupId $landingZonesManagementGroupGuid

Write-Host ($writeEmptyLine + "# Top management groups created" + $writeSeperator + $currentTime)`
-foregroundcolor $foregroundColor1 $writeEmptyLine

## ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

## Create Platform management groups

New-AzManagementGroup -GroupName $managementManagementGroupGuid -DisplayName $managemnetManagementGroupName -ParentObject $platformParentGroup
New-AzManagementGroup -GroupName $connectivityManagementGroupGuid -DisplayName $connectivityManagementGroupName -ParentObject $platformParentGroup

Write-Host ($writeEmptyLine + "# Platform management groups created" + $writeSeperator + $currentTime)`
-foregroundcolor $foregroundColor1 $writeEmptyLine

## ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

## Create Landing Zones management groups

New-AzManagementGroup -GroupName $corpManagementGroupGuid -DisplayName $corpManagementGroupName -ParentObject $landingZonesParentGroup
New-AzManagementGroup -GroupName $onlineManagementGroupGuid -DisplayName $onlineManagementGroupName -ParentObject $landingZonesParentGroup

Write-Host ($writeEmptyLine + "# Landing Zones management groups created" + $writeSeperator + $currentTime)`
-foregroundcolor $foregroundColor1 $writeEmptyLine

## ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

To use the script copy and save the above as Create_Management_Group_Tree_Hierarchy.ps1 or download it from GitHub. Afterwards run the script with Administrator privileges from Windows Terminal, Visual Studio Code, Cloud Shell or Windows PowerShell.

In a previous blog post I have already shown how you can change the display name of the root management group, which can be combined with this script to foresee a uniform naming convention for all your management groups display names.


Management groups are a way to proper organize a companies different Azure subscriptions. They bring more structure, by efficiently managing access, policies and costs in an organizational, environment-based or a combined hierarchy.

Management groups can be up to six levels deep, seven if you include the root management group, and a parent management group can have many child management groups. At the moment a total of up to 10,000 management groups is supported.

Just keep in mind that this number is a limit and definitely not a target. You should avoid to complex structures where it is difficult to keep a good overview or where it is almost impossible to find out which Azure Policy definition or RBAC assignment applies to which child or parent management group.

So I hope this Azure PowerShell script is useful for you and provides a good foundation to foresee a structured management group hierarchy in your Azure ecosystem. If you have any questions or recommendations about it, feel free to contact me through my Twitter handle or to leave a comment.

0 comments on “Azure PowerShell script: Create a management group tree hierarchy

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: