Set a new management group's parent explicitly in a management-group Bicep deployment

Source facts

Azure management groups are tenant-level resources. Bicep can create one during a management-group deployment by giving the new resource tenant scope. Microsoft’s example for creating a child beneath the deployment’s target group additionally sets its parent ID with managementGroup().id. That parent property is distinct from the scope used to declare the resource. Microsoft Learn.

Applicability

Use this distinction when a platform team creates management groups through reusable Bicep. Identify three separate values in the review: the group targeted by the deployment, the scope of the new resource, and its intended parent. Do not approve hierarchy placement from the deployment command alone.

DSE recommendation

DSE recommends reviewing the new group’s parent separately from the deployment’s target scope. Record the intended parent by its full ID and compare that decision with the template’s parent expression. If a module is intended for several organizational branches, make the expected relationship clear at the call site. Require a focused review when a reused deployment moves to a different target group.

Verification

In an authorized test hierarchy, inspect the created group’s actual parent and compare it with the approved design. Repeat with another permitted deployment target to check that the expression produces the intended relationship. Retain the relevant template revision and resulting parent ID. Treat successful resource creation and correct hierarchy placement as separate acceptance checks; do not infer the latter merely from a completed deployment.

Official references

Microsoft Learn. Source retrieved September 9, 2026.