Skip to main content
Version: Next

Task 01: Configure Management Group

Runbook Azure

DOCUMENT CATEGORY: Runbook SCOPE: Simplified deployment — landing zone management group PURPOSE: Create the landing zone management group under the existing root MASTER REFERENCE: Microsoft Learn — Management Groups

Status: Active

Overview​

Create the landing zone management group under the existing root management group. The subscription created in Task 02 will be placed under this landing zone MG.

What This Accomplishes​

  • Landing zone governance boundary — scoped policies and RBAC inheritance for Azure Local resources
  • Subscription organization — the landing zone MG is the parent for the Azure Local subscription
Organization Root Management Group

Every Entra ID tenant has a built-in Tenant Root Group. Your organization root management group (e.g., cmp-iic-root) is created beneath it as a custom MG that serves as the top of your governance hierarchy. If the organization root MG does not exist yet, create it first — see the Full CAF/WAF Task 01 for the procedure. This task creates the landing zone management group beneath it.

Management Group Naming​

Management groups have two identifiers:

PropertyDescriptionCan Change?
ID (GroupName)Used in ARM/Bicep, CLI, and policy assignmentsNo — immutable once created
Display NameShown in Azure PortalYes — editable anytime

Example (IIC)​

AttributeValueSource
Parent MG IDcmp-iic-rootvariables.yml → azure.management_groups.tenant_root.name
Landing Zone MG IDcmp-landing-zones-iicvariables.yml → azure.management_groups.landing_zone.name
Display NameIIC Landing Zone Management Groupvariables.yml → azure.management_groups.landing_zone.display_name

Target Structure​

Tenant Root Group
└── cmp-iic-root # already exists
 └── cmp-landing-zones-iic # ← created in this task

Prerequisites​

  • Organization root management group exists in the tenant (or you will create it — see note above)
  • Permissions: Management Group Contributor (or Owner) on the root management group. You may need to elevate access first.
  • Authenticated Azure session — see Authentication
  • variables.yml configured with management group values

Variables from variables.yml​

VariableConfig PathExample (IIC)
Parent MG IDazure.management_groups.tenant_root.namecmp-iic-root
Landing Zone MG IDazure.management_groups.landing_zone.namecmp-landing-zones-iic
Landing Zone Display Nameazure.management_groups.landing_zone.display_nameIIC Landing Zone Management Group

Execution Options​

Azure Portal​

When to use: Single deployment, prefer visual interface

Procedure​

  1. Navigate to Management Groups:
  • In Azure Portal, search for Management groups
  • Locate the root management group (azure.management_groups.tenant_root.name)
  1. Create the Landing Zone Management Group:
  • Click + Add management group
FieldValueSource
Management group ID<landing-zone-mg-id>variables.yml → azure.management_groups.landing_zone.name
Management group display name<display-name>variables.yml → azure.management_groups.landing_zone.display_name
ParentRoot MG from configvariables.yml → azure.management_groups.tenant_root.name
  1. Save and wait for creation to complete.

Validation​

  • Landing zone MG appears under the root MG in the portal
  • MG ID matches the value in variables.yml
  • Display name is correct

Troubleshooting​

IssueSymptomResolution
Permission deniedAuthorizationFailedVerify Management Group Contributor or Owner role on the root MG
Duplicate IDManagementGroupAlreadyExistsThe MG already exists — verify it's under the correct parent and move on
Parent not foundParentManagementGroupNotFoundConfirm the root MG ID in variables.yml matches what exists in the tenant

Next Steps​

Proceed to Task 02: Create Subscription

References​

PreviousUpNext
Simplified Deployment OverviewSimplified Deployment OverviewTask 02 — Create Subscription

Version Control

  • Created: 2026-01-15 by Hybrid Cloud Solutions
  • Last Updated: 2026-03-19 by Hybrid Cloud Solutions
  • Version: 3.0.0