{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-501-set-a-new-management-group-s-parent-explicitly-in-a-management-group-bicep/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-501-set-a-new-management-group-s-parent-explicitly-in-a-management-group-bicep/", "slug": "dse-20260909-501-set-a-new-management-group-s-parent-explicitly-in-a-management-group-bicep", "url": "https://update.dsesecurity.com/updates/dse-20260909-501-set-a-new-management-group-s-parent-explicitly-in-a-management-group-bicep/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-501-set-a-new-management-group-s-parent-explicitly-in-a-management-group-bicep.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-501-set-a-new-management-group-s-parent-explicitly-in-a-management-group-bicep/" }, "title": "Set a new management group's parent explicitly in a management-group Bicep deployment", "summary": "Does a management-group deployment target automatically establish the intended parent for a new management group?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:23:35+00:00", "modified_at": "2026-09-10T02:11:17+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 240, "potentially_affected": "Bicep deployments that create Azure management groups from a management-group deployment.", "dse_recommendation": "DSE recommends reviewing the new group's parent separately from the deployment's target scope.", "primary_source": { "name": "Use Bicep to deploy resources to management group - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-to-management-group", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure management groups are tenant-level resources. Bicep can create one during a management-group deployment by giving the new resource tenant scope. Microsoft’s example for creating a child beneath the deployment’s target group additionally sets its parent ID with managementGroup().id. That parent property is distinct from the scope used to declare the resource. Microsoft Learn.

\n

Applicability

\n

Use this distinction when a platform team creates management groups through reusable Bicep. Identify three separate values in the review: the group targeted by the deployment, the scope of the new resource, and its intended parent. Do not approve hierarchy placement from the deployment command alone.

\n

DSE recommendation

\n

DSE recommends reviewing the new group’s parent separately from the deployment’s target scope. Record the intended parent by its full ID and compare that decision with the template’s parent expression. If a module is intended for several organizational branches, make the expected relationship clear at the call site. Require a focused review when a reused deployment moves to a different target group.

\n

Verification

\n

In an authorized test hierarchy, inspect the created group’s actual parent and compare it with the approved design. Repeat with another permitted deployment target to check that the expression produces the intended relationship. Retain the relevant template revision and resulting parent ID. Treat successful resource creation and correct hierarchy placement as separate acceptance checks; do not infer the latter merely from a completed deployment.

\n

Official references

\n

Microsoft Learn. Source retrieved September 9, 2026.

", "content_text": "Source facts\nAzure management groups are tenant-level resources. Bicep can create one during a management-group deployment by giving the new resource tenant scope. Microsoft’s example for creating a child beneath the deployment’s target group additionally sets its parent ID with managementGroup().id. That parent property is distinct from the scope used to declare the resource. Microsoft Learn.\nApplicability\nUse this distinction when a platform team creates management groups through reusable Bicep. Identify three separate values in the review: the group targeted by the deployment, the scope of the new resource, and its intended parent. Do not approve hierarchy placement from the deployment command alone.\nDSE recommendation\nDSE recommends reviewing the new group’s parent separately from the deployment’s target scope. Record the intended parent by its full ID and compare that decision with the template’s parent expression. If a module is intended for several organizational branches, make the expected relationship clear at the call site. Require a focused review when a reused deployment moves to a different target group.\nVerification\nIn an authorized test hierarchy, inspect the created group’s actual parent and compare it with the approved design. Repeat with another permitted deployment target to check that the expression produces the intended relationship. Retain the relevant template revision and resulting parent ID. Treat successful resource creation and correct hierarchy placement as separate acceptance checks; do not infer the latter merely from a completed deployment.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nAzure management groups are tenant-level resources. Bicep can create one during a management-group deployment by giving the new resource tenant scope. Microsoft’s example for creating a child beneath the deployment’s target group additionally sets its parent ID with managementGroup().id. That parent property is distinct from the scope used to declare the resource. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-to-management-group).\n\n## Applicability\n\nUse this distinction when a platform team creates management groups through reusable Bicep. Identify three separate values in the review: the group targeted by the deployment, the scope of the new resource, and its intended parent. Do not approve hierarchy placement from the deployment command alone.\n\n## DSE recommendation\n\nDSE recommends reviewing the new group’s parent separately from the deployment’s target scope. Record the intended parent by its full ID and compare that decision with the template’s parent expression. If a module is intended for several organizational branches, make the expected relationship clear at the call site. Require a focused review when a reused deployment moves to a different target group.\n\n## Verification\n\nIn an authorized test hierarchy, inspect the created group’s actual parent and compare it with the approved design. Repeat with another permitted deployment target to check that the expression produces the intended relationship. Retain the relevant template revision and resulting parent ID. Treat successful resource creation and correct hierarchy placement as separate acceptance checks; do not infer the latter merely from a completed deployment.\n\n## Official references\n\n[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-to-management-group). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-501-set-a-new-management-group-s-parent-explicitly-in-a-management-group-bicep/", "url": "https://update.dsesecurity.com/updates/dse-20260909-501-set-a-new-management-group-s-parent-explicitly-in-a-management-group-bicep/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-501-set-a-new-management-group-s-parent-explicitly-in-a-management-group-bicep/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Set a new management group's parent explicitly in a management-group Bicep deployment", "item": "https://update.dsesecurity.com/updates/dse-20260909-501-set-a-new-management-group-s-parent-explicitly-in-a-management-group-bicep/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-501-set-a-new-management-group-s-parent-explicitly-in-a-management-group-bicep/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-501-set-a-new-management-group-s-parent-explicitly-in-a-management-group-bicep/", "url": "https://update.dsesecurity.com/updates/dse-20260909-501-set-a-new-management-group-s-parent-explicitly-in-a-management-group-bicep/", "headline": "Set a new management group's parent explicitly in a management-group Bicep deployment", "description": "Does a management-group deployment target automatically establish the intended parent for a new management group?", "abstract": "Does a management-group deployment target automatically establish the intended parent for a new management group?", "articleBody": "Source facts\nAzure management groups are tenant-level resources. Bicep can create one during a management-group deployment by giving the new resource tenant scope. Microsoft’s example for creating a child beneath the deployment’s target group additionally sets its parent ID with managementGroup().id. That parent property is distinct from the scope used to declare the resource. Microsoft Learn.\nApplicability\nUse this distinction when a platform team creates management groups through reusable Bicep. Identify three separate values in the review: the group targeted by the deployment, the scope of the new resource, and its intended parent. Do not approve hierarchy placement from the deployment command alone.\nDSE recommendation\nDSE recommends reviewing the new group’s parent separately from the deployment’s target scope. Record the intended parent by its full ID and compare that decision with the template’s parent expression. If a module is intended for several organizational branches, make the expected relationship clear at the call site. Require a focused review when a reused deployment moves to a different target group.\nVerification\nIn an authorized test hierarchy, inspect the created group’s actual parent and compare it with the approved design. Repeat with another permitted deployment target to check that the expression produces the intended relationship. Retain the relevant template revision and resulting parent ID. Treat successful resource creation and correct hierarchy placement as separate acceptance checks; do not infer the latter merely from a completed deployment.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:23:35+00:00", "dateModified": "2026-09-10T02:11:17+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-501-set-a-new-management-group-s-parent-explicitly-in-a-management-group-bicep/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-501-set-a-new-management-group-s-parent-explicitly-in-a-management-group-bicep/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Set a new management group's parent explicitly in a management-group Bicep deployment" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 240, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Use Bicep to deploy resources to management group - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-to-management-group" } } ] } }