Azure-docs: Clarification on Subscription's tenant belonging

[smoms]

What does it mean "All subscriptions within a single management group must trust the same Azure Active Directory tenant."? That all Subscription must be part of the same AAD tenant? thanks

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 1527b80e-5270-b5f0-9034-747c6f92ae4e
• Version Independent ID: 50b9882c-dcb0-ecc1-241b-1361ad2fff1e
• Content: Organize your resources with management groups - Azure Governance
• Content Source: articles/governance/management-groups/overview.md
• Service: governance
• GitHub Login: @rthorn17
• Microsoft Alias: rithorn

[Mike-Ubezzi-MSFT]

@smoms Thank you for your inquiry. A tenant is a container that represents an entity such as a business or organization. The following documentation discusses setting-up a tenant:

A tenant is a representation of an organization. It's a dedicated instance of Azure AD that an organization or app developer receives when the organization or app developer creates a relationship with Microsoft-- like signing up for Azure, Microsoft Intune, or Microsoft 365.

Each Azure AD tenant is distinct and separate from other Azure AD tenants and has its own representation of work and school identities, consumer identities (if it's an Azure AD B2C tenant), and app registrations. An app registration inside of your tenant can allow authentications from accounts only within your tenant or all tenants.

So, these Azure Management Groups must be part of the same AAD Tenant that you set-up initially and what defines your organization.

Please let me know if you have additional questions.

Regards,
Mike

[smoms]

@Mike-Ubezzi-MSFT thanks. my question was another though. It is about Subscriptions.
I try to rephrase it:
Are all SUBSCRIPTIONS of a same Management Groups part of (trust) the same Tenant?
thanks.

[rthorn17]

A Management Group Hierarchy needs to be contained within a single AAD tenant, which means all the subscriptions that connect to that particular hierarchy are also. If you have 3 Tenants, you could have 3 different hierarchies. The Management Groups do not span or can cross tenant boundaries.

It resembles this hierarchy path like structure:
Tenant -> Management Groups (self-nested) -> Subs -> RGs -> Resources

[smoms]

@rthorn17 thanks

[Mike-Ubezzi-MSFT]

@smoms We will now proceed to close this thread. If there are further questions regarding this matter, please comment and we will gladly continue the discussion.