CODEWITHSUNDEEP
azureazure-policy
Jul_DW
Jul_DW

Reputation: 1064

Deny the creation of a new management group at root level

I am trying to deny the creation of any additional management group at root level. I enabled the capability of management groups which created the "Tenant Root Group".

I created some more MGs under that one for my governance purposes but I do not want users to be able to create their own. Even without giving them any specific access, it looks that they can (even though it sounds weird to me). I double-checked in IAM panel, nothing specific is there.

Whats displayed in the Azure Portal is like this:

Root Tenant Group 
  |--- ManagementGroup1
  |--- ManagementGroup2
  |--- etc.

"Root Tenant Group" is the one that have been automatically created and that I am trying to lock now that I created my structure.

I wanted to go with an Azure Policy, but whenever I apply it to that Tenant Root Group, it does not prevent the creation of another management group. Actually it looks like in the ARM structure, they are not considered as children at all but as independent items. When I run the command az account management-group show --name MyTenantRootGroup it says "children" is null.

Still, my policy was the following: 

"if": {
    "source":"action",
    "equals":"Microsoft.Management/managementGroups/write"
},
"then": {
    "effect": "deny"
}

Is there any other way to do so ?

Upvotes: 0

Views: 204

Answers (1)

Kemley
Kemley

Reputation: 204

Policy is unable to evaluate policies at a Management group level because of outside limitations. I would recommend submitting your idea to our UserVoice for proper feedback and consideration.

Upvotes: 1

Related Questions