A small environment gets by with one subscription and a few resource groups. A company with many subscriptions needs order above them. This lesson shows the three levels from the administration's point of view: what you do with resource groups, what can happen to a subscription, and how management groups bundle rights and rules.
Nordlicht Reisen GmbH, a fictional travel agency, is growing: one subscription for production, one for development, one for experiments. The audit team is supposed to be able to read everywhere, and one rule is supposed to apply to all.
Prior knowledge: The four levels (management group, subscription, resource group, resource) and what inheritance means are explained in "AZ-900 compact", lesson 2.2. K3, lesson 3.1.3, teaches cutting resource groups by lifecycle, assigning names and tags, setting locks and moving resources. Here you learn the administration the way the exam names it. Tags, locks and policies in detail are lesson 1.5.
Managing resource groups
A resource group is a container for related resources. In the portal, you create one under Resource groups, Create, with subscription, name and region. The command line has these commands:
az group create --name rg-az104-gruppen-a --location germanywestcentral --tags kurs=az104
az group list --query "[].{Name:name, Ort:location}" --output table
az group show --name rg-az104-gruppen-a
az group delete --name rg-az104-gruppen-a --yes --no-wait
New-AzResourceGroup -Name rg-az104-gruppen-a -Location germanywestcentral -Tag @{ kurs = 'az104' }
Get-AzResourceGroup | Select-Object ResourceGroupName, Location
Remove-AzResourceGroup -Name rg-az104-gruppen-a -Force
az group list prints a table with one row per group. With az group list --tag kurs=az104 you show only groups with a tag. az group update --tags replaces all tags of the group with the ones given; whoever wants to add individual ones uses az tag update with --operation Merge (K3, lesson 3.1.3). az group export creates a template from the resources of a group (--export-format with arm, bicep or json); how you read and use it is taught in lesson 3.1.
Deleting takes the group along with everything in it. az group wait --deleted waits until it is gone, az group exists checks it. A lock can prevent deletion (lesson 1.5).
Moving resources
A resource belongs to exactly one group, and you can move it to another group or to another subscription. The most important points from the documentation:
- Both subscriptions must belong to the same tenant. The feature does not move to a different tenant.
- During the move, the source and target groups are locked. You cannot create, delete or change anything in them; the existing resources keep running. The lock can last up to four hours, usually it is faster. Also, a group may take part in only one move at a time.
- The resource ID changes, because it contains the subscription and group. Scripts, templates, dashboards and everything that knows the old ID must be adjusted by you.
- The region does not change. Moving changes only the assigned group. A move to another region is something else (lesson 3.4).
- Only parent resources are named in the command; child resources (for example extensions of a VM) come along. Dependencies on other resources can break and must be set up again.
- Not every resource type can be moved. A read-only lock (
ReadOnly) at the source or target group or at the subscription prevents it. More than 800 resources in one request are rejected by Azure immediately. - A resource group itself cannot be moved to another subscription. You move all resources into a group of the other subscription. Tags, role assignments and policies do not move with them; you set them yourself at the new group.
In the portal: open the group, select the resources, then Move and one of the three options (new resource group, new subscription, new region). The portal checks beforehand whether the move is possible (Validation) and asks for the confirmation that you will adjust scripts and tools. On the command line:
$id = az resource show --resource-group rg-az104-gruppen-a --name nsg-az104-gruppen --resource-type "Microsoft.Network/networkSecurityGroups" --query id --output tsv
az resource move --destination-group rg-az104-gruppen-b --ids $id
$ressource = Get-AzResource -ResourceGroupName rg-az104-gruppen-a -Name nsg-az104-gruppen
Move-AzResource -DestinationResourceGroupName rg-az104-gruppen-b -ResourceId $ressource.ResourceId
--ids takes a space-separated list of resource IDs. For another subscription, --destination-subscription-id is added (in PowerShell -DestinationSubscriptionId). If it fails, the message names the reason, such as MoveCannotProceedWithResourcesNotInSucceededState (if the source or target group contains a virtual network, the state of all resources that depend on it is checked, even if they are not moved; one of them is not in the state "Succeeded"), MissingMoveDependentResources (a dependent resource belongs in the request) or RequestDisallowedByPolicy (a policy prohibits the resource in the target group).