🛡️ Azure Tenant default management group is the root group🟢⚪

• Contextual name: 🛡️ Tenant default management group is the root group🟢⚪
• ID: /ce/ca/azure/microsoft-entra-id/default-management-group
• Tags:
  • ⚪ Impossible policy
  • 🟢 Policy with categories
  • 🟢 Policy with type
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Description

Open File

Description

A tenant places each new subscription under one of two scopes: the root management group, or another management group the organization designates. The Default management group hierarchy setting selects between them for the whole tenant. Prerequisites: Create the management group that will receive new subscriptions and assign it the policies and role assignments that new subscriptions must carry.

Rationale

With the root management group as the default, a new subscription inherits only root- scope policy and role assignments, which organizations often keep minimal because they reach every resource in the tenant. Resources deployed before the subscription is moved run without the organization's guardrails, and compliance reporting scoped to child management groups does not cover them.

Audit

This requirement needs manual assessment. Tenant default management-group setting is not collected; current subscription membership does not establish the default for new subscriptions.

Remediation

Open File

Remediation

A tenant places each new subscription under one of two scopes: the root management group, or another management group the organization designates. The Default management group hierarchy setting selects between them for the whole tenant. Prerequisites: Create the management group that will receive new subscriptions and assign it the policies and role assignments that new subscriptions must carry.

Using an account with Hierarchy Settings Administrator or Owner access on the root management group, open Management groups, select the root group, and open Settings. Choose Change default management group, select the designated group, and save the selection. Verify the hierarchy setting and the placement of a newly created subscription.

Automated assessment is unavailable: Tenant default management-group setting is not collected; current subscription membership does not establish the default for new subscriptions.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 5.8 Ensure the default management group for new subscriptions is not the root management group (Automated)			1		no data
💼 Cloudaware Framework → 💼 General Access Controls			26		no data