Management Group & Policies

SMB Ready Foundation deploys governance at the management group scope — ensuring policies apply to all resources in the subscription, even those created outside of this deployment.

Architecture

Tenant Root Group
└── smb-rf (SMB Ready Foundation)
    ├── Azure Policy assignments (MG + subscription scope)
    └── Subscription: customer-subscription
        ├── rg-hub-smb-swc
        ├── rg-spoke-prod-swc
        ├── rg-monitor-smb-swc
        ├── rg-backup-smb-swc
        ├── rg-security-smb-swc
        └── rg-migrate-smb-swc

One-Time Setup

1. Grant management group permissions (requires Global Administrator)

   cd scripts
   pwsh ./Setup-ManagementGroupPermissions.ps1

   This elevates your account to create management groups at the tenant root level. Only needed once per customer tenant.

2. Create the management group

   az account management-group create --name smb-rf --display-name "SMB Ready Foundation"

3. Associate the customer subscription

   SUBSCRIPTION_ID=$(az account show --query id -o tsv)
   az account management-group subscription add --name smb-rf --subscription $SUBSCRIPTION_ID

Note

After initial setup, the pre-provision hook handles MG creation and policy deployment idempotently on every azd up. You don’t need to repeat these steps.

How Policies Are Deployed

The pre-provision hook (hooks/pre-provision.ps1) deploys policies in two steps:

1. Step 5a: Deploys deploy-mg.bicep to the parent management group — creates the smb-rf MG and associates the subscription (idempotent)
2. Step 5b: Deploys modules/policy-assignments-mg.bicep to the smb-rf MG — creates MG-scoped policy assignments (additional policies are deployed at subscription scope by main.bicep)

Both steps run a what-if preview before deploying.

Policy Categories

Category	Count	Enforcement	Purpose
Compute	6	2 Deny + 4 Audit	VM SKU restrictions, no public IPs, managed disks, classic VMs, updates, endpoint protection
Network	5	1 Deny + 4 Audit	NSG on subnets, restrict ports, disable IP forwarding, flow logs
Storage	5	3 Deny + 2 Audit	HTTPS-only, no public blob, TLS 1.2, restrict network access
Identity	4	4 Audit	SQL Azure AD auth, SQL public access, MFA for owners, blocked accounts
Tagging	2	2 Deny	Require Environment and Owner tags
Key Vault	7	7 Audit	Soft delete, purge protection, RBAC, secrets/keys expiration, resource logs
Monitoring	1	1 Audit	Diagnostic settings required for key resource types
Backup	2	2 Audit	VMs should be backed up, storage geo-redundancy
Governance	1	1 Deny	Allowed resource locations

Total: 9 Deny + 24 Audit + 1 DeployIfNotExists policy assignments

The MG-scoped policies are listed above. Additional policies are deployed at subscription scope by main.bicep: auto-backup enrollment (DINE), VM backup required (Audit), storage geo-redundancy (Audit), and allowed locations (Deny).

For the complete policy catalog with policy definition IDs, see Policy Catalog.

Persistence Across Deployments

Management group resources (the MG itself and its MG-scoped policies) persist across azd up re-deployments. They are not torn down between scenario changes. This is by design:

• Policies apply to the subscription regardless of which scenario is deployed
• Re-deploying policies is idempotent (ARM update-in-place)
• Only resource groups and budget are torn down between scenarios

To fully remove policies, use the cleanup script:

cd infra/bicep/smb-ready-foundation
pwsh scripts/Remove-SmbReadyFoundation.ps1 -Force -RemoveManagementGroup