Planning Azure Deployment Hierarchies

• Enterprises must use Azure deployment hierarchies for administration needs such as billing, access control, and application of policies that restrict how resources are deployed.
• Organizations with Enterprise Agreements should use two Azure hierarchy technologies.
• Older deployments could require reconfiguration to enable the most efficient management.

Two Azure deployment hierarchy technologies allow business and technical administrators to represent structures such as teams, regions, projects, and billing departments to manage their Azure usage. Management groups, a newer technology based on the Azure Resource Manager deployment framework, provides more flexibility and eases the configuration of security and policies. However, the Enterprise Agreement (EA) portal hierarchy remains necessary for enterprise billing management. (See the illustration “Azure EA Portal and Management Group Hierarchies.”)

EA Portal Versus Management Groups

Customer-defined Azure deployment hierarchies provide structure to management processes such as billing reporting and accountability, access control, and deployment policy compliance. For example, assigning Azure accounts to departments within a hierarchy simplifies creating billing reports broken out by each department for internal chargeback; and organizing Azure subscriptions into groups within a hierarchy allows a policy (such as a restriction on the size of VMs that can be created) to be applied to a group of subscriptions with a single action.