Can Azure Policy be applied across multiple subscriptions from a single management group?

Question

Can Azure Policy be applied across multiple subscriptions from a single management group?

Kushi Yadav 100

Sahil Kumar 0 Reputation points

2026-07-02T17:10:56.9866667+00:00

Yes. Azure Policy can be assigned at a Management Group scope, and the policy is automatically inherited by all subscriptions (and their resources) under that management group, unless excluded or overridden where applicable.

Answer accepted by question author

Suchitra Suregaunkar 16,780 Microsoft External Staff Moderator

Hello Kushi Yadav Thank you for posting your query on Microsoft Q&A platform.
Azure Policy can absolutely be applied across multiple subscriptions from a single management group, and this is actually one of the primary use cases management groups are designed for.

Management groups sit one level above subscriptions in the Azure resource hierarchy and act as a governance scope. When you assign an Azure Policy (or Initiative) at the management group level, the assignment automatically cascades down through inheritance to every child management group, subscription, resource group, and resource under it.

For example, if you assign a policy at a management group called Corp that restricts VM deployments to West US only, that rule is enforced across every subscription placed under Corp — and even the subscription owner cannot override it, which gives you consistent, enterprise-wide governance.

A few important points to keep in mind:

Definition location matters — If you want a custom policy definition to be assignable across multiple subscriptions, the definition itself must be saved at a management group that contains those subscriptions (not at an individual subscription).
Single tenant requirement — All subscriptions inside a management group must belong to the same Microsoft Entra (Azure AD) tenant. Cross-tenant policy enforcement isn't supported.
New subscriptions auto-inherit — Any subscription you later move under the management group automatically picks up all inherited policy assignments — no reassignment needed.
Exclusions/Exemptions — If you need to exclude a specific subscription or resource from an inherited policy, you can use the notScopes property on the assignment or configure an Azure Policy exemption.
Hierarchy depth — A management group tree supports up to 6 levels deep (excluding the tenant root and subscription level). Microsoft recommends keeping it relatively flat (3–4 levels) for manageability.

Tenant Root Management Group
└── Corp (MG)   ← Policy assigned here: "Allow VM creation only in West US"
     ├── Subscription: Finance   inherits policy
     ├── Subscription: HR        inherits policy
     └── Subscription: IT        inherits policy

All three subscriptions (and every resource inside them) will enforce the same rule from a single assignment.

Reference:

Hope this clears things up! If it answers your question, please consider marking it as Accepted and upvote so it can help others in the community.

Thanks,

Suchitra.

Suchitra Suregaunkar 16,780 Reputation points Microsoft External Staff Moderator

2026-07-02T17:08:32.46+00:00

Hello Kushi Yadav

If the answer is helpful, could you please click "Accept Answer" & "upvote" it and this helps other community members who may encounter a similar issue in the future.

If you’re still experiencing the problem or need further clarification, please feel free to share additional information so we can continue investigating and assist you further.

Thanks,

Suchitra.

1 additional answer

Your answer

Sahil Kumar 0 Reputation points

2026-07-02T17:10:56.9866667+00:00

Yes. Azure Policy can be assigned at a Management Group scope, and the policy is automatically inherited by all subscriptions (and their resources) under that management group, unless excluded or overridden where applicable.
Suchitra Suregaunkar 16,780 Reputation points Microsoft External Staff Moderator

2026-07-02T17:08:32.46+00:00

Hello Kushi Yadav

If the answer is helpful, could you please click "Accept Answer" & "upvote" it and this helps other community members who may encounter a similar issue in the future.

If you’re still experiencing the problem or need further clarification, please feel free to share additional information so we can continue investigating and assist you further.

Thanks,

Suchitra.

Answer 1

Yes — Azure Policy can be applied across multiple subscriptions if they are organized under a single management group. Policies assigned at the management group level automatically cascade down to all child subscriptions and resources, ensuring consistent governance at scale.

Management Groups
- Provide a governance scope above subscriptions.
- Subscriptions placed under a management group inherit Azure Policy assignments and role-based access control (RBAC) settings.
Policy Inheritance
- When you assign a policy (e.g., restrict VM creation to specific regions) at the management group level, it applies to all nested management groups, subscriptions, and resources.
- Subscription owners cannot override these inherited policies, ensuring compliance.
Tenant Requirement
- All subscriptions in a management group must belong to the same Microsoft Entra tenant (formerly Azure AD).
- Cross-tenant policy enforcement is not supported. Example : -
- Imagine you have 10 subscriptions for different departments (Finance, HR, IT, etc.).
  - Place them under a single management group called “Corp.”
  - Assign a policy at the “Corp” level: “Allow VM creation only in West US region.”
  - Result: All 10 subscriptions automatically enforce this rule, without needing to configure each one individually. Limitations: -
  - Cost Management: Management groups are not supported in cost management features for Microsoft Customer Agreement (MCA) subscriptions.
  - Depth: A management group hierarchy can go up to six levels deep (excluding root and subscription levels).
  - Best Practice: Keep hierarchies relatively flat (3–4 levels) to reduce complexity.