Management Groups and Landing Zone Governance (Scenario)

Practice the management group, subscription, policy, and RBAC governance reasoning that AZ-104 expects, within the permission limits of a Contributor, subscription-scoped service principal.

Management groups are tenant-scoped objects shared across the whole directory. Creating them live is either blocked by the tenant's hierarchy protection or would pollute the shared lab tenant with management groups no cleanup script can remove, so this lab keeps management group design as artifacts. This is a rigorous artifact-and-reasoning lab. You inspect a realistic static governance landscape, design a target management group hierarchy, map how a policy initiative and inherited RBAC flow down the tree, and produce a landing-zone governance decision document.

One task is fully live and Contributor-safe: you create a real resource group, apply governance tags, and confirm them with the Azure CLI and portal. Creating a management lock needs Owner or User Access Administrator (Microsoft.Authorization/locks/write is denied to Contributor), so you author a CanNotDelete lock plan instead. Every other task validates the structure and content of the governance artifacts you author, not live management group creation.