One thing that can get tricky with management groups is moving an existing subscription between branches of the hierarchy.
Imagine moving a production subscription from Corp to a new PCI management group to meet stricter compliance requirements. The subscription doesn't just get a new parent; it inherits a different combination of Azure Policy assignments and RBAC permissions. If custom role definitions or inherited access assignments are tied to the old hierarchy, the move can also fail or leave the workload with unexpected access.
I'd want a pre-move validation step that compares the effective policies and permissions before and after the move, then checks compliance once the new inheritance takes effect. Have you considered adding that kind of impact analysis to the Management Group Planner, rather than limiting it to validating the tree structure itself?
One thing that can get tricky with management groups is moving an existing subscription between branches of the hierarchy.
Imagine moving a production subscription from
Corpto a newPCImanagement group to meet stricter compliance requirements. The subscription doesn't just get a new parent; it inherits a different combination of Azure Policy assignments and RBAC permissions. If custom role definitions or inherited access assignments are tied to the old hierarchy, the move can also fail or leave the workload with unexpected access.I'd want a pre-move validation step that compares the effective policies and permissions before and after the move, then checks compliance once the new inheritance takes effect. Have you considered adding that kind of impact analysis to the Management Group Planner, rather than limiting it to validating the tree structure itself?