{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-175-land-new-azure-subscriptions-in-an-explicit-default-management-group/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-175-land-new-azure-subscriptions-in-an-explicit-default-management-group/", "slug": "dse-20260909-175-land-new-azure-subscriptions-in-an-explicit-default-management-group", "url": "https://update.dsesecurity.com/updates/dse-20260909-175-land-new-azure-subscriptions-in-an-explicit-default-management-group/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-175-land-new-azure-subscriptions-in-an-explicit-default-management-group.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-175-land-new-azure-subscriptions-in-an-explicit-default-management-group/" }, "title": "Land new Azure subscriptions in an explicit default management group", "summary": "Review the hierarchy's default landing group and its inherited controls before onboarding another subscription.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:29:01+00:00", "modified_at": "2026-09-10T00:55:36+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 227, "potentially_affected": "Azure tenants configuring management-group hierarchy settings for new subscriptions.", "dse_recommendation": "Define and test the default management-group landing zone with approved policy and role inheritance.", "primary_source": { "name": "Protect your resource hierarchy - Azure Governance - Azure governance | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/management-groups/how-to/protect-resource-hierarchy", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

A newly added subscription normally joins the tenant’s root management group. Policy and role assignments at that root immediately affect the new subscription. Microsoft provides a hierarchy setting to select a different default management group for new subscriptions.

\n

That lets an organization retain root-level governance while placing additional controls appropriate to new subscriptions on a separate landing group. Permissions to read and update hierarchy settings do not themselves grant other access throughout the hierarchy. Microsoft Learn.

\n

Applicability

\n

Identify the tenant root, current default group, proposed landing group, and inherited assignments. Keep the authority to change the hierarchy setting separate from the service owner’s permissions inside an individual subscription.

\n

DSE recommendation

\n

DSE recommends treating the default group as an onboarding control. Have platform and security owners approve its intended policies and access, then document the process for moving a subscription onward after onboarding. Preserve the old setting and review existing automation that assumes every new subscription initially appears under the root.

\n

Verification

\n

Using an approved test onboarding, inspect the subscription’s actual parent and effective governance. Confirm that intended controls apply and required onboarding work remains possible. Record the hierarchy setting, resulting placement, and any exceptions. Recheck this path after hierarchy or landing-group assignment changes rather than relying on the configured name alone.

\n

Official references

\n

Microsoft Learn: Protect your resource hierarchy – Azure Governance. Source retrieved September 9, 2026.

", "content_text": "Source facts\nA newly added subscription normally joins the tenant’s root management group. Policy and role assignments at that root immediately affect the new subscription. Microsoft provides a hierarchy setting to select a different default management group for new subscriptions.\nThat lets an organization retain root-level governance while placing additional controls appropriate to new subscriptions on a separate landing group. Permissions to read and update hierarchy settings do not themselves grant other access throughout the hierarchy. Microsoft Learn.\nApplicability\nIdentify the tenant root, current default group, proposed landing group, and inherited assignments. Keep the authority to change the hierarchy setting separate from the service owner’s permissions inside an individual subscription.\nDSE recommendation\nDSE recommends treating the default group as an onboarding control. Have platform and security owners approve its intended policies and access, then document the process for moving a subscription onward after onboarding. Preserve the old setting and review existing automation that assumes every new subscription initially appears under the root.\nVerification\nUsing an approved test onboarding, inspect the subscription’s actual parent and effective governance. Confirm that intended controls apply and required onboarding work remains possible. Record the hierarchy setting, resulting placement, and any exceptions. Recheck this path after hierarchy or landing-group assignment changes rather than relying on the configured name alone.\nOfficial references\nMicrosoft Learn: Protect your resource hierarchy – Azure Governance. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nA newly added subscription normally joins the tenant’s root management group. Policy and role assignments at that root immediately affect the new subscription. Microsoft provides a hierarchy setting to select a different default management group for new subscriptions.\n\nThat lets an organization retain root-level governance while placing additional controls appropriate to new subscriptions on a separate landing group. Permissions to read and update hierarchy settings do not themselves grant other access throughout the hierarchy. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/management-groups/how-to/protect-resource-hierarchy).\n\n## Applicability\n\nIdentify the tenant root, current default group, proposed landing group, and inherited assignments. Keep the authority to change the hierarchy setting separate from the service owner’s permissions inside an individual subscription.\n\n## DSE recommendation\n\nDSE recommends treating the default group as an onboarding control. Have platform and security owners approve its intended policies and access, then document the process for moving a subscription onward after onboarding. Preserve the old setting and review existing automation that assumes every new subscription initially appears under the root.\n\n## Verification\n\nUsing an approved test onboarding, inspect the subscription’s actual parent and effective governance. Confirm that intended controls apply and required onboarding work remains possible. Record the hierarchy setting, resulting placement, and any exceptions. Recheck this path after hierarchy or landing-group assignment changes rather than relying on the configured name alone.\n\n## Official references\n\n[Microsoft Learn: Protect your resource hierarchy – Azure Governance](https://learn.microsoft.com/en-us/azure/governance/management-groups/how-to/protect-resource-hierarchy). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-175-land-new-azure-subscriptions-in-an-explicit-default-management-group/", "url": "https://update.dsesecurity.com/updates/dse-20260909-175-land-new-azure-subscriptions-in-an-explicit-default-management-group/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-175-land-new-azure-subscriptions-in-an-explicit-default-management-group/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Land new Azure subscriptions in an explicit default management group", "item": "https://update.dsesecurity.com/updates/dse-20260909-175-land-new-azure-subscriptions-in-an-explicit-default-management-group/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-175-land-new-azure-subscriptions-in-an-explicit-default-management-group/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-175-land-new-azure-subscriptions-in-an-explicit-default-management-group/", "url": "https://update.dsesecurity.com/updates/dse-20260909-175-land-new-azure-subscriptions-in-an-explicit-default-management-group/", "headline": "Land new Azure subscriptions in an explicit default management group", "description": "Review the hierarchy's default landing group and its inherited controls before onboarding another subscription.", "abstract": "Review the hierarchy's default landing group and its inherited controls before onboarding another subscription.", "articleBody": "Source facts\nA newly added subscription normally joins the tenant’s root management group. Policy and role assignments at that root immediately affect the new subscription. Microsoft provides a hierarchy setting to select a different default management group for new subscriptions.\nThat lets an organization retain root-level governance while placing additional controls appropriate to new subscriptions on a separate landing group. Permissions to read and update hierarchy settings do not themselves grant other access throughout the hierarchy. Microsoft Learn.\nApplicability\nIdentify the tenant root, current default group, proposed landing group, and inherited assignments. Keep the authority to change the hierarchy setting separate from the service owner’s permissions inside an individual subscription.\nDSE recommendation\nDSE recommends treating the default group as an onboarding control. Have platform and security owners approve its intended policies and access, then document the process for moving a subscription onward after onboarding. Preserve the old setting and review existing automation that assumes every new subscription initially appears under the root.\nVerification\nUsing an approved test onboarding, inspect the subscription’s actual parent and effective governance. Confirm that intended controls apply and required onboarding work remains possible. Record the hierarchy setting, resulting placement, and any exceptions. Recheck this path after hierarchy or landing-group assignment changes rather than relying on the configured name alone.\nOfficial references\nMicrosoft Learn: Protect your resource hierarchy – Azure Governance. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:29:01+00:00", "dateModified": "2026-09-10T00:55:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-175-land-new-azure-subscriptions-in-an-explicit-default-management-group/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-175-land-new-azure-subscriptions-in-an-explicit-default-management-group/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Land new Azure subscriptions in an explicit default management group" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 227, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Protect your resource hierarchy - Azure Governance - Azure governance | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/management-groups/how-to/protect-resource-hierarchy" } } ] } }